REDHAT-BUG-2144983: Medium severity podman vulnerability
#1podman build ..." follows symlinks when reading .containerignore and .dockerignore We've received this potential security issue with Podman, and although not said, it's really in Buildah. I've asked one of our engineers (Aditya) to fix it upstream, but I think it might be wise to backport to Podman 4.1.1 as noted in the issue.
Please adivise next steps and setup any CVE's or BZ's as appropriate. more information in SNow -> https://redhat.service-now.com/surl.do?n=INC2395282
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2144983?
The severity of REDHAT-BUG-2144983 is classified as a potential security issue due to symlink following in .containerignore and .dockerignore.
How do I fix REDHAT-BUG-2144983?
To fix REDHAT-BUG-2144983, users should update to the latest version of Podman or Buildah that includes the security patch.
Which versions of Red Hat Podman are affected by REDHAT-BUG-2144983?
Red Hat Podman version 4.1.1 and above is affected by REDHAT-BUG-2144983.
What products are associated with REDHAT-BUG-2144983?
The products associated with REDHAT-BUG-2144983 are Red Hat Podman and Buildah.
Is REDHAT-BUG-2144983 a known issue in Buildah?
Yes, REDHAT-BUG-2144983 is recognized as a potential security issue primarily related to Buildah.