A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
#1podman build ..." follows symlinks when reading .containerignore and .dockerignore We've received this potential security issue with Podman, and although not said, it's really in Buildah. I've asked one of our engineers (Aditya) to fix it upstream, but I think it might be wise to backport to Podman 4.1.1 as noted in the issue.
Please adivise next steps and setup any CVE's or BZ's as appropriate. more information in SNow -> https://redhat.service-now.com/surl.do?n=INC2395282
podman machine spawns the gvproxy process, which is intended to forward ports on the host machine to the VM. The gvproxy API runs on Port 7777, but binds to all IPs on the host potentially making private services on the VM accessible to the public internet.
A vulnerability, which was classified as critical, was found in Podman and Varlink 1.5.1. This affects an unknown part of the component API. The manipulation leads to Privilege Escalation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
A flaw was discovered in Podman before upstream version 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first containers will get leaked into subsequent containers. An attacker who has control over those subsequent containers may get access to secrets shared with previous containers through environment variables.
A flaw was found in podman. Rootless containers receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts) which impact containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. The highest threat from this vulnerability is to data integrity.
A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
The podman packages version podman-1.6.4-32.el79 as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 (https://access.redhat.com/errata/RHSA-2022:2190) included an incorrect version of podman that was missing multiple bug and security fixes. One of the fixes regressed in that update was the fix for CVE-2020-14370, that was previously corrected in the podman packages in Red Hat Enterprise Linux 7 Extras via RHSA-2020:5056 (https://access.redhat.com/errata/RHSA-2020:5056). The CVE-2022-2739 was assigned to this security regression and it is specific to the podman packages produced by Red Hat.
The original issue - CVE-2020-14370 - could possibly allow an attacker to gain access to sensitive information stored in environment variables. For more details about the original issue, see:
https://access.redhat.com/security/cve/CVE-2020-14370 https://bugzilla.redhat.com/showbug.cgi?id=CVE-2020-14370
The podman packages version podman-1.6.4-32.el79 as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 (https://access.redhat.com/errata/RHSA-2022:2190) included an incorrect version of podman that was missing multiple bug and security fixes. One of the fixes regressed in that update was the fix for CVE-2020-8945, that was previously corrected in the podman packages in Red Hat Enterprise Linux 7 Extras via RHSA-2020:2117 (https://access.redhat.com/errata/RHSA-2020:2117). The CVE-2022-2738 was assigned to this security regression and it is specific to the podman packages produced by Red Hat.
The original issue - CVE-2020-8945 - could possibly be used to crash or cause potential code execution in Go applications that use the Go GPGME wrapper library, under certain conditions, during GPG signature verification. For more details about the original issue, see:
https://access.redhat.com/security/cve/CVE-2020-8945 https://bugzilla.redhat.com/showbug.cgi?id=CVE-2020-8945