RHSA-2020:5056: Moderate: podman security and bug fix update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.<br>Security Fix(es):<br><li> golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)</li> <li> podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API (CVE-2020-14370)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Bug Fix(es):<br><li> podman does not use $TMPDIR loading a tar file (BZ#1877699)</li>
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2020:5056?
The severity of RHSA-2020:5056 is classified as moderate.
How do I fix RHSA-2020:5056?
To fix RHSA-2020:5056, update the affected podman packages to version 1.6.4-26.el7_9.
What affected software does RHSA-2020:5056 impact?
RHSA-2020:5056 impacts the podman, podman-docker, and podman-debuginfo packages.
Is there a workaround for RHSA-2020:5056?
There is no official workaround for RHSA-2020:5056; upgrading is recommended.
What potential issue does RHSA-2020:5056 address?
RHSA-2020:5056 addresses a vulnerability in the golang.org/x/text library that could trigger an infinite loop.