Nixpkgs Security Tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: podman

Found 12 matching suggestions

View:
Compact
Detailed
Published
Permalink CVE-2025-4953
7.4 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): NONE
updated 1 month ago by @LeSuisse Activity log
  • Created automatic suggestion 6 months, 1 week ago
  • @LeSuisse removed
    7 packages
    • podman-tui
    • podman-bootc
    • podman-compose
    • podman-desktop
    • nomad-driver-podman
    • python312Packages.podman
    • python313Packages.podman
    4 months, 4 weeks ago
  • @LeSuisse accepted 4 months, 4 weeks ago
  • @LeSuisse removed
    2 maintainers
    • @saschagrunert
    • @vdemeester
    1 month ago
  • @LeSuisse published on GitHub 1 month ago
Podman: build context bind mount

A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files accessible.

References

Affected products

runc
  • *
cri-o
  • *
rhcos
  • *
conmon
  • *
kernel
  • *
podman
  • *
  • *
skopeo
  • *
buildah
  • *
haproxy
  • *
ignition
  • *
cri-tools
  • *
kernel-rt
  • *
openshift
  • *
openshift-kuryr
  • *
openshift-ansible
  • *
openshift-clients
  • *
openshift4-aws-iso
  • *
container-tools:rhel8
  • *
containernetworking-plugins
  • *
container-tools:rhel8/podman

Matching in nixpkgs

pkgs.podman

Program for managing pods, containers and container images

  • nixos-unstable -

Package maintainers

Ignored maintainers (2) 
RH/Debian discussion: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117966#22
Untriaged
Permalink CVE-2025-11065
5.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 2 months ago
Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.

References

Affected products

podman
toolbox
openshift
microshift
gvisor-tap-vsock
rhtas/cosign-rhel9
rhtas/fulcio-rhel9
devspaces/udi-rhel9
rhtas/gitsign-rhel9
rhtas/rekor-cli-rhel9
devspaces/traefik-rhel9
opentelemetry-collector
devspaces/udi-base-rhel9
rhacm2/acm-grafana-rhel9
rhoai/odh-rhel9-operator
rhtas/rekor-server-rhel9
openshift-pipelines-client
openshift4/ose-helm-operator
redhat-certification-preflight
rhoai/odh-model-registry-rhel9
openshift-gitops-1/argocd-rhel8
openshift-gitops-1/argocd-rhel9
rhtas/timestamp-authority-rhel9
rhacm2/submariner-rhel9-operator
rhtas/rekor-backfill-redis-rhel9
openshift4/ose-helm-rhel9-operator
github.com/go-viper/mapstructure/v2
  • <2.4.0
rhosdt/opentelemetry-collector-rhel8
rhtap-task-runner/rhtap-task-runner-rhel9
advanced-cluster-security/rhacs-main-rhel8
advanced-cluster-security/rhacs-roxctl-rhel8
advanced-cluster-security/rhacs-rhel8-operator
advanced-cluster-security/rhacs-central-db-rhel8
advanced-cluster-security/rhacs-scanner-v4-rhel8
advanced-cluster-security/rhacs-scanner-v4-db-rhel8
zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9
zero-trust-workload-identity-manager/spiffe-spire-server-rhel9
zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9
zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9

Matching in nixpkgs

pkgs.podman

Program for managing pods, containers and container images

pkgs.bctoolbox

Utilities library for Linphone

pkgs.lttoolbox

Finite state compiler, processor and helper tools used by apertium

Package maintainers

Untriaged
Permalink CVE-2025-9566
8.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months, 1 week ago
Podman: podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1

References

Affected products

pytz
  • *
babel
  • *
cri-o
  • *
rhcos
  • *
future
  • *
kernel
  • *
podman
  • <5.6.1
  • *
poetry
  • *
pysnmp
  • *
pytest
  • *
subunit
  • *
toolbox
  • *
pyflakes
  • *
wasmedge
  • *
cri-tools
  • *
kernel-rt
  • *
openshift
  • *
pyOpenSSL
  • *
pyparsing
  • *
python-py
  • *
python-ddt
  • *
python-dns
  • *
python-m2r
  • *
python-pbr
  • *
python-smi
  • *
python-tox
  • *
python-amqp
  • *
python-case
  • *
python-cleo
  • *
python-cmd2
  • *
python-flit
  • *
python-idna
  • *
python-lark
  • *
python-mako
  • *
python-mock
  • *
python-nose
  • *
python-pint
  • *
python-sure
  • *
python-toml
  • *
python-tooz
  • *
python-vine
  • *
python-zake
  • *
python-zipp
  • *
pysnmpcrypto
  • *
python-attrs
  • *
python-build
  • *
python-cachy
  • *
python-click
  • *
python-cliff
  • *
python-flask
  • *
python-gabbi
  • *
python-kafka
  • *
python-kazoo
  • *
python-kombu
  • *
python-munch
  • *
python-paste
  • *
python-pecan
  • *
python-redis
  • *
python-sushy
  • *
python-tomli
  • *
python-webob
  • *
python-wrapt
  • *
python-yappi
  • *
python-apipkg
  • *
python-bcrypt
  • *
python-editor
  • *
python-extras
  • *
python-flake8
  • *
python-gevent
  • *
python-ifaddr
  • *
python-jinja2
  • *
python-libcst
  • *
python-mccabe
  • *
python-pep517
  • *
python-pluggy
  • *
python-psutil
  • *
python-pyasn1
  • *
python-pycadf
  • *
python-pycurl
  • *
python-pyghmi
  • *
python-pyudev
  • *
python-routes
  • *
python-sphinx
  • *
python-statsd
  • *
python-stestr
  • *
python-alembic
  • *
python-appdirs
  • *
python-betamax
  • *
python-certifi
  • *
python-chardet
  • *
python-cheroot
  • *
python-distlib
  • *
python-dulwich
  • *
python-execnet
  • *
python-hacking
  • *
python-inotify
  • *
python-iso8601
  • *
python-jeepney
  • *
python-keyring
  • *
python-migrate
  • *
python-mistune
  • *
python-msgpack
  • *
python-netaddr
  • *
python-osc-lib
  • *
python-oslo-db
  • *
python-pexpect
  • *
python-pkginfo
  • *
python-portend
  • *
python-pretend
  • *
python-pycdlib
  • *
python-rfc3986
  • *
python-tempita
  • *
python-tempora
  • *
python-tomli-w
  • *
python-tornado
  • *
python-trustme
  • *
python-warlock
  • *
python-wcwidth
  • *
python-webtest
  • *
python3.12-six
  • *
dbus-python3.12
  • *
kata-containers
  • *
pysnmp-lextudio
  • *
python-autopage
  • *
python-colorama
  • *
python-coverage
  • *
python-docutils
  • *
python-eventlet
  • *
python-filelock
  • *
python-fixtures
  • *
python-funcsigs
  • *
python-futurist
  • *
python-greenlet
  • *
python-gunicorn
  • *
python-html5lib
  • *
python-httplib2
  • *
python-iniparse
  • *
python-jmespath
  • *
python-kerberos
  • *
python-logutils
  • *
python-oauthlib
  • *
python-oslo-log
  • *
python-oslotest
  • *
python-pathspec
  • *
python-pygments
  • *
python-requests
  • *
python-retrying
  • *
python-sqlparse
  • *
python-tenacity
  • *
python-testpath
  • *
python-waitress
  • *
python-werkzeug
  • *
python-zeroconf
  • *
python3.12-mypy
  • *
openstack-macros
  • *
python-automaton
  • *
python-construct
  • *
python-crashtest
  • *
python-decorator
  • *
python-editables
  • *
python-fasteners
  • *
python-freezegun
  • *
python-hatch-vcs
  • *
python-hatchling
  • *
python-httpretty
  • *
python-imagesize
  • *
python-jsonpatch
  • *
python-memcached
  • *
python-mimeparse
  • *
python-monotonic
  • *
python-os-traits
  • *
python-oslo-i18n
  • *
python-packaging
  • *
python-pyperclip
  • *
python-soupsieve
  • *
python-stevedore
  • *
python-testtools
  • *
python-typeguard
  • *
python-uhashring
  • *
python-xmlschema
  • *
container-selinux
  • *
openshift-ansible
  • *
openshift-clients
  • *
python-cachetools
  • *
python-defusedxml
  • *
python-dracclient
  • *
python-hypothesis
  • *
python-jsonschema
  • *
python-kiwisolver
  • *
python-linecache2
  • *
python-markupsafe
  • *
python-oslo-cache
  • *
python-oslo-utils
  • *
python-osprofiler
  • *
python-ptyprocess
  • *
python-pyasyncore
  • *
python-pymemcache
  • *
python-pyrsistent
  • *
python-pytest-cov
  • *
python-repoze-lru
  • *
python-rst-linker
  • *
python-simplejson
  • *
python-sqlalchemy
  • *
python-traceback2
  • *
python-virtualenv
  • *
python-voluptuous
  • *
python-websockify
  • *
python-zombie-imp
  • *
python-zope-event
  • *
python3.12-pyyaml
  • *
openshift4-aws-iso
  • *
python-contextlib2
  • *
python-elementpath
  • *
python-jaraco-text
  • *
python-jsonpath-rw
  • *
python-jsonpointer
  • *
python-oslo-config
  • *
python-oslo-policy
  • *
python-poetry-core
  • *
python-prettytable
  • *
python-pycodestyle
  • *
python-pytest-mock
  • *
python-shellingham
  • *
devspaces/udi-rhel9
  • *
python-atomicwrites
  • *
python-cinderclient
  • *
python-glanceclient
  • *
python-hypothesmith
  • *
python-ironicclient
  • *
python-itsdangerous
  • *
python-openstacksdk
  • *
python-oslo-context
  • *
python-oslo-metrics
  • *
python-oslo-service
  • *
python-paste-deploy
  • *
python-platformdirs
  • *
python-pytest-xdist
  • *
python-smi-lextudio
  • *
python-webencodings
  • *
python-zope-testing
  • *
python3.12-dateutil
  • *
python-SecretStorage
  • *
python-async-timeout
  • *
python-debtcollector
  • *
python-dogpile-cache
  • *
python-keystoneauth1
  • *
python-oslo-rootwrap
  • *
python-pyproject-api
  • *
python-pytest-forked
  • *
python-pytest-runner
  • *
python-requests-mock
  • *
python-simplegeneric
  • *
python-testresources
  • *
python-testscenarios
  • *
container-tools:rhel8
  • *
python-beautifulsoup4
  • *
python-jaraco-classes
  • *
python-jaraco-context
  • *
python-keystoneclient
  • *
python-more-itertools
  • *
python-oslo-messaging
  • *
python-pytest-asyncio
  • *
python-pytest-timeout
  • *
python-setuptools_scm
  • *
python-singledispatch
  • *
python-testrepository
  • *
python-typing-inspect
  • *
python-wsgi_intercept
  • *
python-zope-interface
  • *
ephemeral-port-reserve
  • *
python-jsonpath-rw-ext
  • *
python-mypy_extensions
  • *
python-oslo-middleware
  • *
python-pyproject-hooks
  • *
python-pytest-xprocess
  • *
python-snowballstemmer
  • *
python-tox-current-env
  • *
python-binary-memcached
  • *
python-jaraco-functools
  • *
python-jaraco-packaging
  • *
python-os-client-config
  • *
python-os-service-types
  • *
python-oslo-concurrency
  • *
python-service-identity
  • *
python-sortedcontainers
  • *
python-sphinx_rtd_theme
  • *
devspaces/udi-base-rhel9
  • *
python-oslo-upgradecheck
  • *
python-prometheus_client
  • *
python-railroad-diagrams
  • *
python-requests-kerberos
  • *
python-requests-toolbelt
  • *
python-trove-classifiers
  • *
python-typing-extensions
  • *
python-keystonemiddleware
  • *
python-microversion-parse
  • *
python-openstackdocstheme
  • *
python-oslo-serialization
  • *
python-requestsexceptions
  • *
python-pytest-lazy-fixture
  • *
python-requests-unixsocket
  • *
python-pytest-rerunfailures
  • *
python-sphinxcontrib-jquery
  • *
python-sphinxcontrib-jsmath
  • *
python-sphinxcontrib-qthelp
  • *
container-tools:rhel8/podman
python-oslo-versionedobjects
  • *
python-sphinxcontrib-devhelp
  • *
python-sphinx-theme-alabaster
  • *
python-sphinxcontrib-htmlhelp
  • *
python-hatch-fancy-pypi-readme
  • *
python-sphinxcontrib-applehelp
  • *
python-sphinxcontrib-httpdomain
  • *
python-ironic-prometheus-exporter
  • *
python-sphinxcontrib-serializinghtml
  • *
ose-aws-ecr-image-credential-provider
  • *
ose-gcp-gcr-image-credential-provider
  • *
ose-azure-acr-image-credential-provider
  • *

Matching in nixpkgs

pkgs.podman

Program for managing pods, containers and container images

  • nixos-unstable -

pkgs.podman-bootc

Streamlining podman+bootc interactions

  • nixos-unstable -

pkgs.podman-compose

Implementation of docker-compose with podman backend

  • nixos-unstable -

pkgs.podman-desktop

Graphical tool for developing on containers and Kubernetes

  • nixos-unstable -

Package maintainers

Untriaged
Permalink CVE-2025-6032
8.3 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months, 1 week ago
Podman: podman missing tls verification

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

References

Affected products

rhcos
  • *
podman
  • <5.5.2
  • *
container-tools:rhel8
  • *
container-tools:rhel8/podman

Matching in nixpkgs

pkgs.podman

Program for managing pods, containers and container images

  • nixos-unstable -

pkgs.podman-bootc

Streamlining podman+bootc interactions

  • nixos-unstable -

pkgs.podman-compose

Implementation of docker-compose with podman backend

  • nixos-unstable -

pkgs.podman-desktop

Graphical tool for developing on containers and Kubernetes

  • nixos-unstable -

Package maintainers

Untriaged
Permalink CVE-2024-11218
8.6 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months, 1 week ago
Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.

References

Affected products

rhcos
  • *
podman
  • *
buildah
  • <1.33.12
  • <1.38.1
  • <1.35.5
  • *
  • <1.37.6
container-tools:rhel8
  • *
container-tools:rhel8/podman
container-tools:rhel8/buildah

Matching in nixpkgs

pkgs.podman

Program for managing pods, containers and container images

  • nixos-unstable -

pkgs.buildah

Tool which facilitates building OCI images

  • nixos-unstable -

pkgs.podman-bootc

Streamlining podman+bootc interactions

  • nixos-unstable -

pkgs.podman-compose

Implementation of docker-compose with podman backend

  • nixos-unstable -

pkgs.podman-desktop

Graphical tool for developing on containers and Kubernetes

  • nixos-unstable -

Package maintainers

Untriaged
Permalink CVE-2024-9676
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months, 1 week ago
Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.

References

Affected products

cri-o
  • *
conmon
podman
  • *
skopeo
buildah
  • *
containers/storage
  • <1.55.1
container-tools:rhel8
  • *
quay/quay-builder-rhel8
ocp-tools-4/jenkins-rhel8
container-tools:rhel8/conmon
container-tools:rhel8/podman
container-tools:rhel8/skopeo
container-tools:rhel8/buildah
openshift4/ose-docker-builder
  • *
jenkins-agent-base-rhel9-container
openshift4/ose-docker-builder-rhel9
  • *
ocp-tools-4/jenkins-agent-base-rhel8

Matching in nixpkgs

pkgs.cri-o

Open Container Initiative-based implementation of the Kubernetes Container Runtime Interface

  • nixos-unstable -

pkgs.conmon

OCI container runtime monitor

  • nixos-unstable -

pkgs.podman

Program for managing pods, containers and container images

  • nixos-unstable -

pkgs.skopeo

Command line utility for various operations on container images and image repositories

  • nixos-unstable -

pkgs.buildah

Tool which facilitates building OCI images

  • nixos-unstable -

pkgs.conmon-rs

OCI container runtime monitor written in Rust

  • nixos-unstable -

pkgs.podman-bootc

Streamlining podman+bootc interactions

  • nixos-unstable -

pkgs.podman-compose

Implementation of docker-compose with podman backend

  • nixos-unstable -

pkgs.podman-desktop

Graphical tool for developing on containers and Kubernetes

  • nixos-unstable -

pkgs.cri-o-unwrapped

Open Container Initiative-based implementation of the Kubernetes Container Runtime Interface

  • nixos-unstable -

Package maintainers

Untriaged
Permalink CVE-2024-9675
4.4 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months, 1 week ago
Buildah: buildah allows arbitrary directory mount

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

References

Affected products

cri-o
conmon
podman
  • *
skopeo
buildah
  • *
  • <1.38.0
buildah-container
container-tools:rhel8
  • *
quay/quay-builder-rhel8
ocp-tools-4/jenkins-rhel8
container-tools:rhel8/conmon
container-tools:rhel8/podman
container-tools:rhel8/skopeo
container-tools:rhel8/buildah
openshift4/ose-docker-builder
  • *
openshift4/ose-docker-builder-rhel9
  • *
ocp-tools-4/jenkins-agent-base-rhel8
openshift-enterprise-builder-container
  • *

Matching in nixpkgs

pkgs.cri-o

Open Container Initiative-based implementation of the Kubernetes Container Runtime Interface

  • nixos-unstable -

pkgs.conmon

OCI container runtime monitor

  • nixos-unstable -

pkgs.podman

Program for managing pods, containers and container images

  • nixos-unstable -

pkgs.skopeo

Command line utility for various operations on container images and image repositories

  • nixos-unstable -

pkgs.buildah

Tool which facilitates building OCI images

  • nixos-unstable -

pkgs.conmon-rs

OCI container runtime monitor written in Rust

  • nixos-unstable -

pkgs.podman-bootc

Streamlining podman+bootc interactions

  • nixos-unstable -

pkgs.podman-compose

Implementation of docker-compose with podman backend

  • nixos-unstable -

pkgs.podman-desktop

Graphical tool for developing on containers and Kubernetes

  • nixos-unstable -

pkgs.cri-o-unwrapped

Open Container Initiative-based implementation of the Kubernetes Container Runtime Interface

  • nixos-unstable -

Package maintainers

Untriaged
Permalink CVE-2024-9407
4.7 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months, 1 week ago
Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

References

Affected products

rhcos
  • *
podman
  • <1.5.0
  • <5.2.4
  • *
buildah
  • <1.9.1
  • <1.37.4
  • *
container-tools:rhel8
  • *
container-tools:rhel8/podman
container-tools:rhel8/buildah
openshift4/ose-docker-builder
openshift4/ose-docker-builder-rhel9

Matching in nixpkgs

pkgs.podman

Program for managing pods, containers and container images

  • nixos-unstable -

pkgs.buildah

Tool which facilitates building OCI images

  • nixos-unstable -

pkgs.podman-bootc

Streamlining podman+bootc interactions

  • nixos-unstable -

pkgs.podman-compose

Implementation of docker-compose with podman backend

  • nixos-unstable -

pkgs.podman-desktop

Graphical tool for developing on containers and Kubernetes

  • nixos-unstable -

Package maintainers

Untriaged
Permalink CVE-2024-9341
5.4 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months, 1 week ago
Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.

References

Affected products

cri-o
  • *
rhcos
  • *
podman
  • *
buildah
  • *
container-tools:rhel8
  • *
container-tools:rhel8/podman
github.com/containers/common
  • <0.60.4
container-tools:rhel8/buildah
openshift4/ose-docker-builder
openshift4/ose-docker-builder-rhel9

Matching in nixpkgs

pkgs.cri-o

Open Container Initiative-based implementation of the Kubernetes Container Runtime Interface

  • nixos-unstable -

pkgs.podman

Program for managing pods, containers and container images

  • nixos-unstable -

pkgs.buildah

Tool which facilitates building OCI images

  • nixos-unstable -

pkgs.podman-bootc

Streamlining podman+bootc interactions

  • nixos-unstable -

pkgs.podman-compose

Implementation of docker-compose with podman backend

  • nixos-unstable -

pkgs.podman-desktop

Graphical tool for developing on containers and Kubernetes

  • nixos-unstable -

pkgs.cri-o-unwrapped

Open Container Initiative-based implementation of the Kubernetes Container Runtime Interface

  • nixos-unstable -

Package maintainers

Untriaged
Permalink CVE-2024-3056
4.8 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months, 1 week ago
Podman: containers in shared ipc namespace are vulnerable to denial of service attack

A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least one other container, can create a large number of IPC resources in /dev/shm. The malicious container will continue to exhaust resources until it is out-of-memory (OOM) killed. While the malicious container's cgroup will be removed, the IPC resources it created are not. Those resources are tied to the IPC namespace that will not be removed until all containers using it are stopped, and one non-malicious container is holding the namespace open. The malicious container is restarted, either automatically or by attacker control, repeating the process and increasing the amount of memory consumed. With a container configured to restart always, such as `podman run --restart=always`, this can result in a memory-based denial of service of the system.

References

Affected products

kernel
podman
  • ==5.0.0
kernel-rt
container-tools:4.0/podman
container-tools:rhel8/podman

Matching in nixpkgs

pkgs.podman

Program for managing pods, containers and container images

  • nixos-unstable -

pkgs.linux-doc

Linux kernel html documentation

  • nixos-unstable -

pkgs.coq-kernel

None

  • nixos-unstable -
    • nixpkgs-unstable

pkgs.kernelshark

GUI for trace-cmd which is an interface for the Linux kernel ftrace subsystem

  • nixos-unstable -

pkgs.podman-bootc

Streamlining podman+bootc interactions

  • nixos-unstable -

pkgs.podman-compose

Implementation of docker-compose with podman backend

  • nixos-unstable -

pkgs.podman-desktop

Graphical tool for developing on containers and Kubernetes

  • nixos-unstable -

Package maintainers