Nixpkgs security tracker
Permalink
CVE-2025-11395
5.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Adjacent (A)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): Low (L)
- Modified Attack Vector (MAV): Adjacent (A)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): Low (L)
Activity log
- Created suggestion
Podman: arbitrary file write when importing oci archive
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.
References
Affected products
rhcos
podman
skopeo
buildah
devspaces/udi-rhel9
devspaces/udi-base-rhel9
container-tools:rhel8/podman
Matching in nixpkgs
pkgs.podman
Program for managing pods, containers and container images
pkgs.skopeo
Command line utility for various operations on container images and image repositories
pkgs.buildah
Tool which facilitates building OCI images
pkgs.podman-tui
Podman Terminal UI
pkgs.podman-bootc
Streamlining podman+bootc interactions
pkgs.cockpit-podman
Cockpit UI for podman containers
pkgs.podman-compose
Implementation of docker-compose with podman backend
pkgs.podman-desktop
Graphical tool for developing on containers and Kubernetes
pkgs.buildah-unwrapped
Tool which facilitates building OCI images
pkgs.nomad-driver-podman
Podman task driver for Nomad
pkgs.python313Packages.podman
Python bindings for Podman's RESTful API
pkgs.python314Packages.podman
Python bindings for Podman's RESTful API
Package maintainers
-
@vdemeester Vincent Demeester <vincent@sbr.pm>
-
@saschagrunert Sascha Grunert <mail@saschagrunert.de>
-
@andre4ik3 andre4ik3 <andre4ik3@fastmail.com>
-
@lucasew Lucas Eduardo Wendt <lucas59356@gmail.com>
-
@alexandru0-dev Alexandru Nechita <alexandru.italia32+nixpkgs@gmail.com>
-
@cpcloud Phillip Cloud
-
@evan-goode Evan Goode <mail@evangoo.de>
-
@sikmir Nikolay Korotkiy <sikmir@disroot.org>
-
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
-
@aaronjheng Aaron Jheng <wentworth@outlook.com>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@developer-guy Batuhan Apaydın <developerguyn@gmail.com>
-
@nlewo Antoine Eiche <lewo@abesis.fr>
-
@ryan4yin Ryan Yin <xiaoyin_c@qq.com>