Summary
[5.6.0-6.0.1]
- Add devices on container startup, not on creation
- overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694]
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]
[7:5.6.0-6]
- update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
(https://github.com/containers/podman/commit/2791007)
- fixes '[Minor Incident] CVE-2025-52881 podman: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [rhel-10.1.z]'
- Resolves: RHEL-126635
[7:5.6.0-5]
- update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
(https://github.com/containers/podman/commit/61231e1)
- fixes 'Timeouts while pushing Sigstore logs to Rekor - [RHEL 10.1] 0day'
- Resolves: RHEL-111077
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | podman | 7:5.6.0-6.0.1.el10_1 |
| Oracle Linux · 10 | podman-docker | 7:5.6.0-6.0.1.el10_1 |
| Oracle Linux · 10 | podman-remote | 7:5.6.0-6.0.1.el10_1 |
| Oracle Linux · 10 | podman-tests | 7:5.6.0-6.0.1.el10_1 |
Vulnerabilities 1
-
High 7.3CVE-2025-52881 Public exploit
runc: LSM labels can be bypassed with malicious config using dummy procfs files
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with s…