high8.8
CVE-2022-1227
Podman publishes a malicious image to public registries
Impact
Podman is a tool for managing OCI containers and pods. A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/containers/psgo | < 1.7.2 | 1.7.2 |
| go | github.com/containers/podman/v3 | < 3.4 | 3.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Podman Project | Podman | before 4.0.0 |
| Psgo Project | Psgo | before 1.7.2 |
| Redhat | Developer Tools | Version 1.0 |
| Redhat | Enterprise Linux Server Update Services For Sap Solutions | Version 8.6 |
| Redhat | Openshift Container Platform | Version 4.0 |
| Redhat | Quay | Version 3.0.0 |
| Redhat | Enterprise Linux | Versions 7.0, 8.0 |
| Redhat | Enterprise Linux Eus | Version 8.6 |
| Redhat | Enterprise Linux For Ibm Z Systems | Versions 7.0, 8.6 |
| Redhat | Enterprise Linux For Power Little Endian | Versions 7.0, 8.6 |
| Redhat | Enterprise Linux Server | Version 7.0 |
| Redhat | Enterprise Linux Server Aus | Version 8.6 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2070368
- https://github.com/containers/podman/issues/10941
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/
- https://security.netapp.com/advisory/ntap-20240628-0001/
- https://github.com/advisories/GHSA-66vw-v2x9-hw75
- https://nvd.nist.gov/vuln/detail/CVE-2022-1227
- https://github.com/containers/psgo/pull/92
- https://pkg.go.dev/vuln/GO-2022-0558
- https://github.com/containers/podman/pull/13862
- https://github.com/containers/podman/pull/13862/commits/79a3e149c10f74db4cebff624287385c90179d09
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ
- https://security.netapp.com/advisory/ntap-20240628-0001