RHSA-2022:8431: Low: podman security, bug fix, and enhancement update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.Security Fix(es): podman: possible information disclosure and modification (CVE-2022-2989) buildah: possible information disclosure and modification (CVE-2022-2990) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Bug Fix(es): (podman image trust) does not support the new trust type "sigstoreSigned " (BZ#2120436) dnf-update broken for podman/catatonit (BZ#2123319) podman creates lock file in /etc/cni/net.d/cni.lock instead of /run/lock/ (BZ#2123905) podman kill may deadlock [RHEL 9.1] (BZ#2124716) containers config.json gets empty after sudden power loss (BZ#2136278) PANIC podman API service endpoint handler panic (BZ#2136287) Enhancement(s): Podman volume plugin timeout should be configurable [rhel-9.1.0 Z] (BZ#2124676) [RFE]Podman support to perform custom actions on unhealthy containers (BZ#2136281)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/podmanto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
redhat/podman-catatonitto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
redhat/podman-catatonit-debuginfoto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
redhat/podman-debuginfoto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
redhat/podman-debugsourceto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
redhat/podman-dockerto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
redhat/podman-gvproxyto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
redhat/podman-gvproxy-debuginfoto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
redhat/podman-pluginsto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
redhat/podman-plugins-debuginfoto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
redhat/podman-remoteto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
redhat/podman-remote-debuginfoto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
redhat/podman-teststo a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
redhat/podmanto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1.aa - Upgrade
Upgrade
redhat/podman-catatonitto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1.aa - Upgrade
Upgrade
redhat/podman-catatonit-debuginfoto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1.aa - Upgrade
Upgrade
redhat/podman-debuginfoto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1.aa - Upgrade
Upgrade
redhat/podman-debugsourceto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1.aa - Upgrade
Upgrade
redhat/podman-gvproxyto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1.aa - Upgrade
Upgrade
redhat/podman-gvproxy-debuginfoto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1.aa - Upgrade
Upgrade
redhat/podman-pluginsto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1.aa - Upgrade
Upgrade
redhat/podman-plugins-debuginfoto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1.aa - Upgrade
Upgrade
redhat/podman-remoteto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1.aa - Upgrade
Upgrade
redhat/podman-remote-debuginfoto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1.aa - Upgrade
Upgrade
redhat/podman-teststo a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1.aa - Upgrade
Upgrade
podmanto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
podman-catatonitto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
podman-dockerto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
podman-gvproxyto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
podman-pluginsto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
podman-remoteto a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1 - Upgrade
Upgrade
podman-teststo a version that resolves this vulnerability.Fixed in 4.2.0-7.el9_1
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:8431?
The severity of RHSA-2022:8431 is classified as critical due to potential information disclosure and modification risks.
How do I fix RHSA-2022:8431?
To fix RHSA-2022:8431, you should upgrade to the podman package version 4.2.0-7.el9_1 or later.
What vulnerabilities are addressed in RHSA-2022:8431?
RHSA-2022:8431 addresses vulnerabilities in the podman tool related to possible information disclosure and modification.
Which versions of podman are affected by RHSA-2022:8431?
Versions of podman prior to 4.2.0-7.el9_1 are affected by RHSA-2022:8431.
Is RHSA-2022:8431 applicable to all distributions?
RHSA-2022:8431 specifically applies to the Red Hat distribution of podman.