Podman

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

Published: 2023-03-27T00:00:00.000Z
Updated: 2025-02-24T17:25:59.179Z

A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.

Published: 2022-12-08T00:00:00.000Z
Updated: 2025-04-22T20:33:21.916Z

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure.

Published: 2022-12-08T00:00:00.000Z
Updated: 2025-04-22T20:30:06.788Z

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

Published: 2022-09-13T13:41:00.000Z
Updated: 2025-06-05T18:15:28.374Z

The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-14370, which was previously fixed via RHSA-2020:5056. This issue could possibly allow an attacker to gain access to sensitive information stored in environment variables.

Published: 2022-09-01T20:51:02.000Z
Updated: 2024-08-03T00:46:04.095Z