Red Hat Security Advisory

RHSA-2024:2548

podman security and bug fix update

Released 2024-04-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) podman-4:4.9.4-3.el9_4, podman-docker-4:4.9.4-3.el9_4, podman-plugins-4:4.9.4-3.el9_4 +2

Fixes 2 records

TI-2024-01631 CVE-2024-1753 · GHSA-874v-pj72-92f3

Buildah: buildah: container escape via improper bind mount validation

HIGH 72

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers.

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.00457 Published 2024-03-18 Partial fix · 8090020240413110917.d7b6f4b7, 8090020240417184044.e7857ab1 +17 CWE-59

TI-2024-16303 CVE-2024-24786 · GHSA-8r3f-844c-mc37

Infinite loop in JSON unmarshaling in google.golang.org/protobuf

MEDIUM 41

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01262 Published 2024-03-05 Partial fix · 1.33.0 CWE-835