Description
A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker can use this flaw to trick a user, with privileges to pull container images, into crashing the process responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | containers/image | containers-image 5.2.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | buildah +1 | 1.11.6-7.module+el8.2.0+5856+b8046c6d | RHSA-2020:1650 |
| RHEL 8 | cockpit-podman | 12-1.module+el8.2.0+5950+6d183a6a | RHSA-2020:1650 |
| RHEL 8 | conmon | 2:2.0.6-1.module+el8.2.0+5182+3136e5d4 | RHSA-2020:1650 |
| RHEL 8 | container-selinux | 2:2.124.0-1.module+el8.2.0+5182+3136e5d4 | RHSA-2020:1650 |
| RHEL 8 | containernetworking-plugins | 0.8.3-5.module+el8.2.0+5201+6b31f0d9 | RHSA-2020:1650 |
| RHEL 8 | crit +2 | 3.12-9.module+el8.2.0+5029+3ac48e7d | RHSA-2020:1650 |
| RHEL 8 | fuse-overlayfs | 0.7.2-5.module+el8.2.0+6060+9dbc027d | RHSA-2020:1650 |
| RHEL 8 | podman +3 | 1.6.4-10.module+el8.2.0+6063+e761893a | RHSA-2020:1650 |
| RHEL 8 | python-podman-api | 1.2.0-0.2.gitd0a45fe.module+el8.2.0+5201+6b31f0d9 | RHSA-2020:1650 |
| RHEL 8 | runc | 1.0.0-65.rc10.module+el8.2.0+5762+aaee29fb | RHSA-2020:1650 |
| RHEL 8 | skopeo +2 | 1:0.1.40-10.module+el8.2.0+5955+6cd70ceb | RHSA-2020:1650 |
| RHEL 8 | slirp4netns | 0.4.2-3.git21fdece.module+el8.2.0+5658+9a15711d | RHSA-2020:1650 |
| RHEL 8 | toolbox | 0.0.7-1.module+el8.2.0+6096+9c3f08f3 | RHSA-2020:1650 |
| RHEL 8 | udica | 0.2.1-2.module+el8.2.0+4896+8f613c81 | RHSA-2020:1650 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Other 7 | buildah | 1.11.6-11.el7_8 | RHSA-2020:2116 |
| Red Hat Rhel Extras Other 7 | docker +7 | 2:1.13.1-161.git64e9980.el7_8 | RHSA-2020:1234 |
| Red Hat Rhel Extras Other 7 | podman +1 | 1.6.4-16.el7_8 | RHSA-2020:1227 |
| Red Hat Rhel Extras Other 7 | skopeo +1 | 1:0.1.40-11.el7_8 | RHSA-2020:2681 |
| Red Hat OpenShift 4 | cri-o | 1.17.4-8.dev.rhaos4.4.git5f5c5e4.el7 | RHSA-2020:1937 |
| Red Hat OpenShift 3 | cri-o | 1.11.16-0.9.dev.rhaos3.11.git6d43aae.el7 | RHSA-2020:2218 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | crit +2 | 3.12-9.module_el8.3.0+2044+12421f43 | ALSA-2020:1650 |
| AlmaLinux 8 | python-podman-api | 1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455 | ALSA-2020:1650 |
| AlmaLinux 8 | slirp4netns | 0.4.2-3.git21fdece.module_el8.5.0+108+00865455 | ALSA-2020:1650 |
| AlmaLinux 8 | toolbox | 0.0.7-1.module_el8.5.0+108+00865455 | ALSA-2020:1650 |
| AlmaLinux 8 | udica | 0.2.1-2.module_el8.5.0+108+00865455 | ALSA-2020:1650 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | container-selinux | 2:2.124.0-1.gitf958d0c.module+el8.5.0+681+c9a1951f | RLSA-2020:1650 |
| Rocky Linux 8 | criu | 3.12-9.module+el8.4.0+557+48ba8b2f | RLSA-2020:1650 |
| Rocky Linux 8 | python-podman-api | 1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2 | RLSA-2020:1650 |
| Rocky Linux 8 | runc | 1.0.0-65.rc10.module+el8.4.0+559+c02fa3b2 | RLSA-2020:1650 |
| Rocky Linux 8 | slirp4netns | 0.4.2-3.git21fdece.module+el8.4.0+536+994a2182 | RLSA-2020:1650 |
| Rocky Linux 8 | toolbox | 0.0.7-1.module+el8.4.0+559+c02fa3b2 | RLSA-2020:1650 |
| Rocky Linux 8 | udica | 0.2.1-2.module+el8.4.0+559+c02fa3b2 | RLSA-2020:1650 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | buildah +1 | 1.11.6-7.0.1.module+el8.2.0+5584+b2b2d3fb | ELSA-2020-1650 |
| Oracle Linux 8 | cockpit-podman | 12-1.module+el8.2.0+5584+b2b2d3fb | ELSA-2020-1650 |
| Oracle Linux 8 | conmon | 2:2.0.6-1.0.1.module+el8.2.0+5584+b2b2d3fb | ELSA-2020-1650 |
| Oracle Linux 8 | container-selinux | 2:2.124.0-1.module+el8.2.0+5584+b2b2d3fb | ELSA-2020-1650 |
| Oracle Linux 8 | containernetworking-plugins | 0.8.3-5.0.1.module+el8.2.0+5584+b2b2d3fb | ELSA-2020-1650 |
| Oracle Linux 8 | crit +2 | 3.12-9.module+el8.2.0+5584+b2b2d3fb | ELSA-2020-1650 |
| Oracle Linux 8 | fuse-overlayfs | 0.7.2-5.module+el8.2.0+5584+b2b2d3fb | ELSA-2020-1650 |
| Oracle Linux 8 | podman +3 | 1.6.4-10.0.1.module+el8.2.0+5584+b2b2d3fb | ELSA-2020-1650 |
| Oracle Linux 8 | python-podman-api | 1.2.0-0.2.gitd0a45fe.module+el8.2.0+5584+b2b2d3fb | ELSA-2020-1650 |
| Oracle Linux 8 | runc | 1.0.0-65.rc10.module+el8.2.0+5584+b2b2d3fb | ELSA-2020-1650 |
| Oracle Linux 8 | skopeo +2 | 1:0.1.40-10.0.1.module+el8.2.0+5584+b2b2d3fb | ELSA-2020-1650 |
| Oracle Linux 8 | slirp4netns | 0.4.2-3.git21fdece.module+el8.2.0+5584+b2b2d3fb | ELSA-2020-1650 |
| Oracle Linux 8 | udica | 0.2.1-2.module+el8.2.0+5584+b2b2d3fb | ELSA-2020-1650 |
Advisories 11
- ALSA-2020:1650 Moderate: container-tools:rhel8 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 31, 2026
- RHSA-2020:2116 Red Hat Security Advisory: buildah security and bug fix update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2020:2681 Red Hat Security Advisory: skopeo security and bug fix update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2020:2218 Red Hat Security Advisory: OpenShift Container Platform 3.11 security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2020:1937 Red Hat Security Advisory: OpenShift Container Platform 4.4.3 cri-o security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2020:1650 Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2020:1234 Red Hat Security Advisory: docker security and bug fix update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2020:1227 Red Hat Security Advisory: podman security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RLSA-2020:1650 Moderate: container-tools:rhel8 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- WID-SEC-2023-2982 Red Hat OpenShift Container Platform: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 21, 2023
- ELSA-2020-1650 Moderate: container-tools:ol8 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 5, 2020