CVE-2022-2989
First published: Mon Aug 22 2022(Updated: )
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/buildah | <1:1.27.0-2.el9 | 1:1.27.0-2.el9 |
| redhat/podman | <2:4.2.0-7.el9_1 | 2:4.2.0-7.el9_1 |
| Podman Project Podman | ||
| Redhat Openshift Container Platform | =3.11 | |
| Redhat Openshift Container Platform | =4.0 | |
| Redhat Enterprise Linux | =7.0 | |
| Redhat Enterprise Linux | =8.0 | |
| Redhat Enterprise Linux | =9.0 | |
| go/github.com/containers/podman/v3 | <3.0.1 | 3.0.1 |
| go/github.com/containers/podman/v4 | <4.2.0 | 4.2.0 |
| ubuntu/libpod | <3.4.4+ | 3.4.4+ |
| debian/libpod | <=3.0.1+dfsg1-3+deb11u4 | 4.3.1+ds1-8 4.9.0+ds1-2 4.9.2+ds1-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2022-2989
- https://bugzilla.redhat.com/show_bug.cgi?id=2121445
- https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
- https://github.com/containers/podman/pull/15618
- https://github.com/containers/podman/pull/15677
- https://github.com/containers/podman/pull/15696
- https://access.redhat.com/errata/RHSA-2022:7822
- https://access.redhat.com/errata/RHSA-2022:8008
- https://access.redhat.com/errata/RHSA-2022:8431
- https://access.redhat.com/security/cve/CVE-2022-2989
- https://github.com/advisories/GHSA-4wjj-jwc9-2x96 (Advisory)
- https://launchpad.net/bugs/cve/CVE-2022-2989
- https://github.com/containers/podman/commit/5c7f28336171f0a5137edd274e45608120d31289
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2121542#c4
- https://access.redhat.com/security/cve/cve-2022-2989
- https://access.redhat.com/errata/RHSA-2023:2802
- https://www.cve.org/CVERecord?id=CVE-2022-2989 https://nvd.nist.gov/vuln/detail/CVE-2022-2989 https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
- https://github.com/containers/podman/commit/21540161f20daffd884eba99b2cc31373c9a0ec4
- https://security-tracker.debian.org/tracker/CVE-2022-2989
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2989
- https://ubuntu.com/security/notices/USN-6295-1
- https://ubuntu.com/security/CVE-2022-2989
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-2989?
CVE-2022-2989 is a vulnerability in the Podman container engine that involves incorrect handling of supplementary groups, potentially leading to sensitive information disclosure or data modification.
What is the severity of CVE-2022-2989?
CVE-2022-2989 has a severity rating of 7.1 (High).
Which software is affected by CVE-2022-2989?
The software affected by CVE-2022-2989 includes buildah (version 1.27.0-2.el9), podman (version 4.2.0-7.el9_1), libpod (version 3.4.4+), and github.com/containers/podman/v3 (version 3.0.1), among others.
How can CVE-2022-2989 be mitigated?
To mitigate CVE-2022-2989, it is recommended to apply the appropriate software updates provided by the respective vendors.
Where can I find more information about CVE-2022-2989?
More information about CVE-2022-2989 can be found at the following references: <ul><li><a href="https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/" target="_blank">https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/</a></li><li><a href="https://github.com/containers/podman/commit/5c7f28336171f0a5137edd274e45608120d31289" target="_blank">https://github.com/containers/podman/commit/5c7f28336171f0a5137edd274e45608120d31289</a></li><li><a href="https://github.com/containers/podman/pull/15696" target="_blank">https://github.com/containers/podman/pull/15696</a></li></ul>
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/github-advisory
- alias/GHSA-4wjj-jwc9-2x96
- alias/CVE-2022-2989
- collector/launchpad-cve
- source/Launchpad
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- collector/redhat-cve
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- collector/usn-cve
- source/Ubuntu
- package-manager/go
- vendor/podman project
- vendor/redhat
- canonical/podman project podman
- canonical/redhat openshift container platform
- version/redhat openshift container platform/3.11
- version/redhat openshift container platform/4.0
- canonical/redhat enterprise linux
- version/redhat enterprise linux/7.0
- version/redhat enterprise linux/8.0
- version/redhat enterprise linux/9.0
- package-manager/redhat
- package-manager/debian
- package-manager/ubuntu