Red Hat Security Advisory: podman security update

Fixed packages 9

Vulnerabilities 3

• High 7.8
  CVE-2024-9675

  Buildah: buildah allows arbitrary directory mount

  A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) int…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Linux Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 9, 2024
• Medium 6.5
  CVE-2024-9676

  Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)

  A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an au…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9.4 Extended Update Support Linux Debian Ubuntu Azure Linux Alpine
  Oct 15, 2024
• Medium 4.7
  CVE-2024-9407

  Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction

  A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exp…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 1, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315887
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2317458
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2317467
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9051.json
• report
  https://access.redhat.com/security/cve/CVE-2024-9407
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9407
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9407
• advisory
  https://github.com/advisories/GHSA-fhqq-8f65-5xfc
• report
  https://access.redhat.com/security/cve/CVE-2024-9675
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9675
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9675
• report
  https://access.redhat.com/security/cve/CVE-2024-9676
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9676
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9676
• advisory
  https://github.com/advisories/GHSA-wq2p-5pc6-wpgf
• article
  https://github.com/containers/storage/commit/935c58f4b3e364a9c9d33ed06476a831e6ad5679