Description
A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | podman | unknown | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | libpod | 4.3.1+ds1-7 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | libpod | No fix yet | — |
| Ubuntu Pro 22.04 LTS | libpod | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | buildah +1 | 1:1.24.6-5.module+el8.8.0+18083+cd85596b | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | cockpit-podman | 46-1.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | conmon | 2:2.1.4-1.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | container-selinux | 2:2.199.0-1.module+el8.8.0+18113+8b5b6979 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | containernetworking-plugins | 1:1.1.1-2.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | containers-common | 2:1-37.module+el8.8.0+17954+9046de88 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | crit +4 | 3.15-3.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | crun | 1.6-1.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | fuse-overlayfs | 1.9-1.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | libslirp +1 | 4.4.0-1.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | netavark +1 | 2:1.0.1-37.module+el8.8.0+17954+9046de88 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | oci-seccomp-bpf-hook | 1.2.5-2.module+el8.8.0+18083+cd85596b | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | podman +6 | 2:4.0.2-20.module+el8.8.0+18201+6ad7332c | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | python-podman +1 | 4.0.0-1.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | runc | 1:1.1.4-1.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | skopeo +1 | 2:1.6.2-6.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | slirp4netns | 1.1.8-2.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | toolbox +1 | 0.0.99.3-7.module+el8.8.0+18115+45021590 | RHSA-2023:2802, RHSA-2023:2758 |
| RHEL 8 | udica | 0.2.6-3.module+el8.8.0+17821+de1b53f1 | RHSA-2023:2802, RHSA-2023:2758 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openshift Ironic 4 | python-werkzeug +1 | 2.0.3-4.el9 | RHSA-2023:1325 |
| Red Hat OpenShift 4 | buildah +1 | 1:1.29.1-1.rhaos4.13.el9 | RHSA-2023:1325 |
| Red Hat OpenShift 4 | cri-o | 1.26.3-3.rhaos4.13.git641290e.el9 | RHSA-2023:1325 |
| Red Hat OpenShift 4 | haproxy +1 | 2.2.24-3.rhaos4.13.el8 | RHSA-2023:1325 |
| Red Hat OpenShift 4 | openshift +1 | 4.13.0-202304211155.p0.gb404935.assembly.stream.el8 | RHSA-2023:1325 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8 | RHSA-2023:1325 |
| Red Hat OpenShift 4 | podman +6 | 3:4.4.1-3.rhaos4.13.el8 | RHSA-2023:1325 |
| Red Hat OpenShift 4 | python-werkzeug +1 | 1.0.1-3.el8ost | RHSA-2023:1325 |
| Red Hat OpenShift 4 | skopeo +1 | 2:1.10.0-1.rhaos4.13.el9 | RHSA-2023:1325 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | buildah +1 | 1:1.24.6-5.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | cockpit-podman | 46-1.module_el8.7.0+3344+5bcd850f | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | conmon | 2:2.1.4-1.module_el8.7.0+3344+5bcd850f | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | container-selinux | 2:2.199.0-1.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | containernetworking-plugins | 1:1.1.1-2.module_el8.7.0+3344+5bcd850f | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | containers-common | 2:1-37.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | crit +4 | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | crun | 1.6-1.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | fuse-overlayfs | 1.9-1.module_el8.7.0+3344+5bcd850f | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | libslirp +1 | 4.4.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | netavark +1 | 2:1.0.1-37.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | podman +6 | 2:4.0.2-20.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | python3-podman | 4.0.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | runc | 1:1.1.4-1.module_el8.7.0+3344+5bcd850f | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | skopeo +1 | 2:1.6.2-6.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | slirp4netns | 1.1.8-2.module_el8.6.0+2877+8e437bf5 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | toolbox +1 | 0.0.99.3-7.module_el8.8.0+3468+16b86c82 | ALSA-2023:2802, ALSA-2023:2758 |
| AlmaLinux 8 | udica | 0.2.6-3.module_el8.6.0+2886+d33c3efb | ALSA-2023:2802, ALSA-2023:2758 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | cockpit-podman | 46-1.module+el8.9.0+1445+07728297 | RLSA-2023:2802 |
| Rocky Linux 8 | criu | 3.15-3.module+el8.9.0+1445+07728297 | RLSA-2023:2802, RLSA-2023:2758 |
| Rocky Linux 8 | libslirp | 4.4.0-1.module+el8.9.0+1445+07728297 | RLSA-2023:2802, RLSA-2023:2758 |
| Rocky Linux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module+el8.9.0+1445+07728297 | RLSA-2023:2802 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | podman | 4.4.4-150400.4.16.1 | SUSE-SU-2023:1814-1 |
| SLES 15 SP3 | podman | 4.4.4-150300.9.20.1 | SUSE-SU-2023:1812-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | podman | 4.4.4-150300.9.20.1 | SUSE-SU-2023:1812-1 |
| SLE Micro 5.4 | podman | 4.4.4-150400.4.16.1 | SUSE-SU-2023:1814-1 |
| SLE Micro 5.3 | podman | 4.4.4-150400.4.16.1 | SUSE-SU-2023:1814-1 |
| SLE Micro 5.2 | podman | 4.4.4-150300.9.20.1 | SUSE-SU-2023:1812-1 |
| SLE Micro 5.1 | podman | 4.4.4-150300.9.20.1 | SUSE-SU-2023:1812-1 |
| SLE HPC 15 SP3 | podman | 4.4.4-150300.9.20.1 | SUSE-SU-2023:1812-1 |
| SUSE Enterprise Storage 7.1 | podman | 4.4.4-150300.9.20.1 | SUSE-SU-2023:1812-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | podman | 4.4.2-1.1 | openSUSE-SU-2024:12771-1 |
| openSUSE Leap 15.4 | podman | 4.4.4-150400.4.16.1 | SUSE-SU-2023:1814-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.3 | podman | 4.4.4-150400.4.16.1 | SUSE-SU-2023:1814-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | podman | 4.4.2-r0 | — |
| Alpine v3.23 | podman | 4.4.2-r0 | — |
| Alpine v3.22 | podman | 4.4.2-r0 | — |
| Alpine v3.21 | podman | 4.4.2-r0 | — |
| Alpine v3.20 | podman | 4.4.2-r0 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | podman | 4.4.2-r0 | — |
| Alpine v3.18 | podman | 4.4.2-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | podman | 5.6.1-2 | — |
| Azure Linux 2 (CBL-Mariner) | cri-o | 1.22.3-10 | — |
| Azure Linux 2 (CBL-Mariner) | podman | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | buildah +1 | 1:1.24.6-5.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | cockpit-podman | 46-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | conmon | 2:2.1.4-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | container-selinux | 2:2.199.0-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | containernetworking-plugins | 1:1.1.1-2.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | containers-common | 2:1-37.0.1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | crit +4 | 3.15-3.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | crun | 1.6-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | fuse-overlayfs | 1.9-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | libslirp +1 | 4.4.0-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | netavark +1 | 2:1.0.1-37.0.1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | podman +6 | 2:4.0.2-20.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | python3-podman | 4.0.0-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | runc | 1:1.1.4-1.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | skopeo +1 | 2:1.6.2-6.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | slirp4netns | 1.1.8-2.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
| Oracle Linux 8 | udica | 0.2.6-3.module+el8.8.0+20984+ab6ce66c | ELSA-2023-2802, ELSA-2023-2758 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/containers/podman/v4 | < 4.4.2 | 4.4.2 | GHSA-qwqv-rqgf-8qh8 |
Advisories 12
- ALSA-2023:2802 Moderate: container-tools:4.0 security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2758 Moderate: container-tools:rhel8 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2023:2802 Red Hat Security Advisory: container-tools:4.0 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:2758 Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:1325 Red Hat Security Advisory: OpenShift Container Platform 4.13.0 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- SUSE-SU-2023:1812-1 Security update for podman SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12771-1 podman-4.4.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:1814-1 Security update for podman SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2023:2802 Moderate: container-tools:4.0 security and bug fix update Rocky Linux Security Advisories · Nov 28, 2025
- RLSA-2023:2758 Moderate: container-tools:rhel8 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 28, 2025
- ELSA-2023-2758 Moderate: container-tools:ol8 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 23, 2023
- ELSA-2023-2802 Moderate: container-tools:4.0 security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 23, 2023