Summary
[5.6.0-7.0.1]
- Add devices on container startup, not on creation
- overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694]
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]
[6:5.6.0-7]
- update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
(https://github.com/containers/podman/commit/2791007)
- fixes '[Minor Incident] CVE-2025-52881 podman: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [rhel-9.7.z]'
- Resolves: RHEL-126913
[6:5.6.0-6]
- update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
(https://github.com/containers/podman/commit/61231e1)
- fixes 'Timeouts while pushing Sigstore logs to Rekor - [RHEL 9.7] 0day'
- Resolves: RHEL-111076
[6:5.6.0-5]
- rebuild as last build was built in the wrong tag
- Related: RHEL-110317
[6:5.6.0-4]
- update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
(https://github.com/containers/podman/commit/c5a3735)
- fixes 'Can not find network create and rm message from podman event when set --events-backend to journald - [RHEL 9.7] 0day'
- Resolves: RHEL-110317
[6:5.6.0-3]
- update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
(https://github.com/containers/podman/commit/7078b79)
- fixes 'CVE-2025-9566 podman: Podman kube play command may overwrite host files [rhel-9.7]'
- Resolves: RHEL-113151
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | podman | 6:5.6.0-7.0.1.el9_7 |
| Oracle Linux · 9 | podman-docker | 6:5.6.0-7.0.1.el9_7 |
| Oracle Linux · 9 | podman-plugins | 6:5.6.0-7.0.1.el9_7 |
| Oracle Linux · 9 | podman-remote | 6:5.6.0-7.0.1.el9_7 |
| Oracle Linux · 9 | podman-tests | 6:5.6.0-7.0.1.el9_7 |
Vulnerabilities 1
-
High 7.3CVE-2025-52881 Public exploit
runc: LSM labels can be bypassed with malicious config using dummy procfs files
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with s…