REDHAT-BUG-2144983
First published: Tue Nov 22 2022(Updated: )
#1podman build ..." follows symlinks when reading .containerignore and .dockerignore We've received this potential security issue with Podman, and although not said, it's really in Buildah. I've asked one of our engineers (Aditya) to fix it upstream, but I think it might be wise to backport to Podman 4.1.1 as noted in the issue. Please adivise next steps and setup any CVE's or BZ's as appropriate. more information in SNow -> <a href="https://redhat.service-now.com/surl.do?n=INC2395282">https://redhat.service-now.com/surl.do?n=INC2395282</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Podman | >=4.1.1 | |
| Buildah |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://redhat.service-now.com/surl.do?n=INC2395282
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2145047
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2145048
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2145049
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2148225
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2148226
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2148227
- https://access.redhat.com/errata/RHSA-2024:2077
- https://access.redhat.com/errata/RHSA-2024:9102
- https://bugzilla.redhat.com/show_bug.cgi?id=2144983
Frequently Asked Questions
What is the severity of REDHAT-BUG-2144983?
The severity of REDHAT-BUG-2144983 is classified as a potential security issue due to symlink following in .containerignore and .dockerignore.
How do I fix REDHAT-BUG-2144983?
To fix REDHAT-BUG-2144983, users should update to the latest version of Podman or Buildah that includes the security patch.
Which versions of Red Hat Podman are affected by REDHAT-BUG-2144983?
Red Hat Podman version 4.1.1 and above is affected by REDHAT-BUG-2144983.
What products are associated with REDHAT-BUG-2144983?
The products associated with REDHAT-BUG-2144983 are Red Hat Podman and Buildah.
Is REDHAT-BUG-2144983 a known issue in Buildah?
Yes, REDHAT-BUG-2144983 is recognized as a potential security issue primarily related to Buildah.
- agent/type
- agent/first-publish-date
- agent/severity
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-4122
- agent/last-modified-date
- agent/references
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/podman
- canonical/buildah