Suggestions search

All statuses

Filter by:

With package: skopeo

Found 2 matching suggestions

View:

Compact

Detailed

Untriaged

Permalink CVE-2025-11395

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Adjacent (A)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Adjacent (A)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

created 2 days, 4 hours ago Activity log

Created suggestion 2 days, 4 hours ago

Podman: arbitrary file write when importing oci archive

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.

References

https://access.redhat.com/security/cve/CVE-2025-11395 vdb-entryx_refsource_REDHAT
RHBZ#2402034 issue-trackingx_refsource_REDHAT

Affected products

rhcos

podman

skopeo

buildah

devspaces/udi-rhel9

devspaces/udi-base-rhel9

container-tools:rhel8/podman

Matching in nixpkgs

pkgs.podman

Program for managing pods, containers and container images

nixos-unstable 5.8.4
- nixpkgs-unstable 5.8.4
- nixos-unstable-small 5.8.6
nixos-26.05 5.8.2
- nixos-26.05-small 5.8.6
- nixpkgs-26.05-darwin 5.8.2

pkgs.skopeo

Command line utility for various operations on container images and image repositories

nixos-unstable 1.23.0
- nixpkgs-unstable 1.23.0
- nixos-unstable-small 1.24.0
nixos-26.05 1.22.2
- nixos-26.05-small 1.22.2
- nixpkgs-26.05-darwin 1.22.2

pkgs.buildah

Tool which facilitates building OCI images

nixos-unstable 1.44.0
- nixpkgs-unstable 1.44.0
- nixos-unstable-small 1.45.0
nixos-26.05 1.43.1
- nixos-26.05-small 1.43.1
- nixpkgs-26.05-darwin 1.43.1

pkgs.podman-tui

Podman Terminal UI

nixos-unstable 1.11.2
- nixpkgs-unstable 1.11.3
- nixos-unstable-small 1.11.3
nixos-26.05 1.11.1
- nixos-26.05-small 1.11.1
- nixpkgs-26.05-darwin 1.11.1

pkgs.podman-bootc

Streamlining podman+bootc interactions

nixos-unstable 0.1.2
- nixpkgs-unstable 0.1.2
- nixos-unstable-small 0.1.2
nixos-26.05 0.1.2
- nixos-26.05-small 0.1.2
- nixpkgs-26.05-darwin 0.1.2

pkgs.cockpit-podman

Cockpit UI for podman containers

nixos-unstable 128
- nixpkgs-unstable 128
- nixos-unstable-small 129
nixos-26.05 125
- nixos-26.05-small 125
- nixpkgs-26.05-darwin 125

pkgs.podman-compose

Implementation of docker-compose with podman backend

nixos-unstable 1.6.0
- nixpkgs-unstable 1.6.0
- nixos-unstable-small 1.6.0
nixos-26.05 1.5.0
- nixos-26.05-small 1.5.0
- nixpkgs-26.05-darwin 1.5.0

pkgs.podman-desktop

Graphical tool for developing on containers and Kubernetes

nixos-unstable 1.27.2
- nixpkgs-unstable 1.27.2
- nixos-unstable-small 1.29.3
nixos-26.05 1.26.2
- nixos-26.05-small 1.28.2
- nixpkgs-26.05-darwin 1.26.2

pkgs.buildah-unwrapped

Tool which facilitates building OCI images

nixos-unstable 1.44.0
- nixpkgs-unstable 1.44.0
- nixos-unstable-small 1.45.0
nixos-26.05 1.43.1
- nixos-26.05-small 1.43.1
- nixpkgs-26.05-darwin 1.43.1

pkgs.nomad-driver-podman

Podman task driver for Nomad

nixos-unstable 0.6.4
- nixpkgs-unstable 0.6.4
- nixos-unstable-small 0.6.5
nixos-26.05 0.6.4
- nixos-26.05-small 0.6.4
- nixpkgs-26.05-darwin 0.6.4

pkgs.python313Packages.podman

Python bindings for Podman's RESTful API

nixos-unstable 5.8.0
- nixpkgs-unstable 5.8.0
- nixos-unstable-small 5.8.0
nixos-26.05 5.8.0
- nixos-26.05-small 5.8.0
- nixpkgs-26.05-darwin 5.8.0

pkgs.python314Packages.podman

Python bindings for Podman's RESTful API

nixos-unstable 5.8.0
- nixpkgs-unstable 5.8.0
- nixos-unstable-small 5.8.0
nixos-26.05 5.8.0
- nixos-26.05-small 5.8.0
- nixpkgs-26.05-darwin 5.8.0

Package maintainers

@saschagrunert Sascha Grunert <mail@saschagrunert.de>
@vdemeester Vincent Demeester <vincent@sbr.pm>
@lucasew Lucas Eduardo Wendt <lucas59356@gmail.com>
@andre4ik3 andre4ik3 <andre4ik3@fastmail.com>
@alexandru0-dev Alexandru Nechita <alexandru.italia32+nixpkgs@gmail.com>
@cpcloud Phillip Cloud
@evan-goode Evan Goode <mail@evangoo.de>
@sikmir Nikolay Korotkiy <sikmir@disroot.org>
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
@aaronjheng Aaron Jheng <wentworth@outlook.com>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@nlewo Antoine Eiche <lewo@abesis.fr>
@ryan4yin Ryan Yin <xiaoyin_c@qq.com>
@developer-guy Batuhan Apaydın <developerguyn@gmail.com>

Untriaged

Permalink CVE-2026-79699

4.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

created 2 days, 4 hours ago Activity log

Created suggestion 2 days, 4 hours ago

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.