REDHAT-BUG-2116923
First published: Tue Aug 09 2022(Updated: )
The podman packages version podman-1.6.4-32.el7_9 as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 (<a href="https://access.redhat.com/errata/RHSA-2022:2190">https://access.redhat.com/errata/RHSA-2022:2190</a>) included an incorrect version of podman that was missing multiple bug and security fixes. One of the fixes regressed in that update was the fix for <a href="https://access.redhat.com/security/cve/CVE-2020-8945">CVE-2020-8945</a>, that was previously corrected in the podman packages in Red Hat Enterprise Linux 7 Extras via RHSA-2020:2117 (<a href="https://access.redhat.com/errata/RHSA-2020:2117">https://access.redhat.com/errata/RHSA-2020:2117</a>). The <a href="https://access.redhat.com/security/cve/CVE-2022-2738">CVE-2022-2738</a> was assigned to this security regression and it is specific to the podman packages produced by Red Hat. The original issue - <a href="https://access.redhat.com/security/cve/CVE-2020-8945">CVE-2020-8945</a> - could possibly be used to crash or cause potential code execution in Go applications that use the Go GPGME wrapper library, under certain conditions, during GPG signature verification. For more details about the original issue, see: <a href="https://access.redhat.com/security/cve/CVE-2020-8945">https://access.redhat.com/security/cve/CVE-2020-8945</a> <a href="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-8945">https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-8945</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Podman |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2022:2190
- https://access.redhat.com/security/cve/CVE-2020-8945
- https://access.redhat.com/errata/RHSA-2020:2117
- https://access.redhat.com/security/cve/CVE-2022-2738
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-8945
- https://access.redhat.com/errata/RHSA-2022:6119
- https://access.redhat.com/security/cve/cve-2022-2738
- https://bugzilla.redhat.com/show_bug.cgi?id=2116923
Frequently Asked Questions
What is the severity of REDHAT-BUG-2116923?
The severity of REDHAT-BUG-2116923 is classified as moderate.
How do I fix REDHAT-BUG-2116923?
To fix REDHAT-BUG-2116923, update to the latest version of the Podman package as advised in the patch release.
What are the consequences of not addressing REDHAT-BUG-2116923?
Failing to address REDHAT-BUG-2116923 may lead to system instability and potential vulnerabilities in the podman application.
Which systems are affected by REDHAT-BUG-2116923?
REDHAT-BUG-2116923 affects Red Hat Enterprise Linux 7 users with the podman package version podman-1.6.4-32.el7_9.
What should I check after updating for REDHAT-BUG-2116923?
After updating for REDHAT-BUG-2116923, verify that the podman application is functioning correctly and look for any other related updates.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-2738
- agent/severity
- agent/event
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/podman