Nixpkgs security tracker

Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-79699
4.4 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
created 2 days, 1 hour ago Activity log
  • Created suggestion 2 days, 1 hour ago
Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

References

Affected products

podman
skopeo
buildah
rhel9/podman
rhel9/skopeo
python-podman
rhel9/buildah
python3x-podman
python3.11-podman
python3.12-podman
devspaces/udi-rhel9
quay/quay-builder-rhel8
quay/quay-builder-rhel9
devspaces/udi-base-rhel9
devspaces/udi-base-rhel10
ansible-automation-platform-24/eda-controller-rhel8
ansible-automation-platform-25/eda-controller-rhel8
ansible-automation-platform-26/eda-controller-rhel9
ansible-automation-platform-27/eda-controller-rhel9
container-native-virtualization/ocp-virt-validation-checkup-rhel9

Matching in nixpkgs

pkgs.podman

Program for managing pods, containers and container images

pkgs.skopeo

Command line utility for various operations on container images and image repositories

pkgs.cockpit-podman

Cockpit UI for podman containers

  • nixos-unstable 128
    • nixpkgs-unstable 128
    • nixos-unstable-small 129
  • nixos-26.05 125
    • nixos-26.05-small 125
    • nixpkgs-26.05-darwin 125

Package maintainers