RLSA-2025:15904 — Important: container-tools:rhel8 security update

Summary

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* podman: Podman kube play command may overwrite host files (CVE-2025-9566)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 130

Release	Package	Fixed in
Rocky Linux · 8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1874+ce489889
Rocky Linux · 8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	aardvark-dns	2:1.10.1-2.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	buildah	2:1.33.12-2.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1874+ce489889
Rocky Linux · 8	containernetworking-plugins	1:1.4.0-6.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	containers-common	2:1-82.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	containers-common	2:1-82.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	containers-common	2:1-82.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	containers-common	2:1-82.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	containers-common	2:1-82.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	containers-common	2:1-82.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	containers-common	2:1-82.module+el8.10.0+1874+ce489889
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1874+ce489889
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1874+ce489889
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1874+ce489889
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	podman	4:4.9.4-23.module+el8.10.0+2064+309a12a4
Rocky Linux · 8	python-podman	0:4.9.0-3.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	python-podman	0:4.9.0-3.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	python-podman	0:4.9.0-3.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	runc	1:1.1.12-6.module+el8.10.0+1933+1fc610b1
Rocky Linux · 8	runc	1:1.1.12-6.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	runc	1:1.1.12-6.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	skopeo	2:1.14.5-4.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1872+2e18eb19.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1874+ce489889.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1829+9bb2696f.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1843+6892ab28.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+2001+6a33db9f.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1948+4b5cd4a9.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1825+623b0c20.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1880+8e896d1b.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1896+b18fa106.rocky.0.2
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1874+ce489889
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+2001+6a33db9f
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1872+2e18eb19

Vulnerabilities 2

High 8.1

CVE-2025-9566

Podman: podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, …

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Alpine Go

Sep 5, 2025
High 7.4

CVE-2025-4953

Podman: build context bind mount

A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on th…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Go

Sep 16, 2025

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=2367235
report
https://bugzilla.redhat.com/show_bug.cgi?id=2393152

Important: container-tools:rhel8 security update

Summary

Fixed packages 130

Vulnerabilities 2

Podman: podman kube play command may overwrite host files

Podman: build context bind mount

References