Description
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Dev Spaces | — | — |
| Red Hat | Red Hat OpenShift Virtualization 4 | — | — |
| Red Hat | Red Hat Quay 3 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-containers-storage | No fix yet | — |
| Debian 13 | golang-github-containers-storage | No fix yet | — |
| Debian 12 | golang-github-containers-storage | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-containers-storage | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-containers-storage | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-containers-storage | No fix yet | — |
| Ubuntu 20.04 LTS | golang-github-containers-storage | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | golang-github-containers-storage | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | skopeo | 1.14.4-150300.11.25.1 | SUSE-SU-2026:5193-1 |
| SLES 15 SP6 | skopeo | 1.14.4-150300.11.25.1 | SUSE-SU-2026:5193-1 |
| SLES 15 SP5 | skopeo | 1.14.4-150300.11.25.1 | SUSE-SU-2026:5193-1 |
| SLES 15 SP4 | skopeo | 1.14.4-150300.11.25.1 | SUSE-SU-2026:5193-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | skopeo | 1.14.4-150300.11.25.1 | SUSE-SU-2026:5193-1 |
| SLES for SAP 15 SP5 | skopeo | 1.14.4-150300.11.25.1 | SUSE-SU-2026:5193-1 |
| SLES for SAP 15 SP4 | skopeo | 1.14.4-150300.11.25.1 | SUSE-SU-2026:5193-1 |
| SLE Micro 5.5 | skopeo | 1.14.4-150300.11.25.1 | SUSE-SU-2026:5193-1 |
| SLE HPC 15 SP5 | skopeo | 1.14.4-150300.11.25.1 | SUSE-SU-2026:5193-1 |
| SLE HPC 15 SP4 | skopeo | 1.14.4-150300.11.25.1 | SUSE-SU-2026:5193-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | podman | 6.1.2-1.1 | openSUSE-SU-2026:12068-1 |
| openSUSE Tumbleweed | skopeo | 1.24.0-2.1 | openSUSE-SU-2026:12478-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | podman | 5.8.8-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | buildah | 2:1.43.1-1.amzn2023.0.4 | ALAS2023-2026-3451 |
| Amazon Linux 2023 | skopeo +1 | 2:1.22.2-1.amzn2023.0.4 | ALAS2023-2026-3450 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cri-o +6 | No fix yet | — |
Advisories 5
- SUSE-SU-2026:5193-1 Security update for skopeo SUSE / openSUSE Security Updates · Nov 12, 2026
- ALAS2023-2026-3450 Important: skopeo security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- ALAS2023-2026-3451 Important: buildah security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- openSUSE-SU-2026:12478-1 skopeo-1.24.0-2.1 on GA media SUSE / openSUSE Security Updates · Nov 7, 2026
- openSUSE-SU-2026:12068-1 podman-6.1.2-1.1 on GA media SUSE / openSUSE Security Updates · Oct 7, 2026
References
- https://access.redhat.com/security/cve/CVE-2026-79699 vdb-entry
- RHBZ#2523408 issue-tracking