Summary
[5.8.2-3.0.1]
- Rework CNI/Netavark detection logic [JIRA: EVG-3769]
- Rebuild on new golang to support experimental GODEBUG fipsnoenforceems
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]
[6:5.8.2-3]
- Rebuild for CVE-2026-32283
- Resolves: RHEL-167685
[6:5.8.2-2]
- Rebuild for CVE-2026-25679
- Resolves: RHEL-158781
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | podman | 6:5.8.2-3.0.1.el9_8 |
| Oracle Linux · 9 | podman-docker | 6:5.8.2-3.0.1.el9_8 |
| Oracle Linux · 9 | podman-plugins | 6:5.8.2-3.0.1.el9_8 |
| Oracle Linux · 9 | podman-remote | 6:5.8.2-3.0.1.el9_8 |
| Oracle Linux · 9 | podman-tests | 6:5.8.2-3.0.1.el9_8 |
Vulnerabilities 3
-
High 7.5
Unexpected work during chain building in crypto/x509
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…
-
High 7.5
Inefficient policy validation in crypto/x509
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chain…
-
High 7.5
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.