Low: podman security, bug fix, and enhancement update

2022-11-1500:00:00

Google

osv.dev

podman

security

bug fix

enhancement

kubernetes

cve-2022-2989

cve-2022-2990

bz#2120436

bz#2123319

bz#2123905

bz#2124676

bz#2136281

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

17.8%

JSON

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

podman: possible information disclosure and modification (CVE-2022-2989)
buildah: possible information disclosure and modification (CVE-2022-2990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

(podman image trust) does not support the new trust type "sigstoreSigned " (BZ#2120436)
dnf-update broken for podman/catatonit (BZ#2123319)
podman creates lock file in /etc/cni/net.d/cni.lock instead of /run/lock/ (BZ#2123905)
podman kill may deadlock [AlmaLinux 9.1] (BZ#2124716)
containers config.json gets empty after sudden power loss (BZ#2136278)
PANIC podman API service endpoint handler panic (BZ#2136287)

Enhancement(s):

Podman volume plugin timeout should be configurable [almalinux-9.1.0 Z] (BZ#2124676)
[RFE]Podman support to perform custom actions on unhealthy containers (BZ#2136281)