Red Hat Security AdvisoryRHSA-2026:67450
podman security update
Released 2026-09-14 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v.9.6) podman-5:5.4.0-22.el9_6.5, podman-docker-5:5.4.0-22.el9_6.5, podman-plugins-5:5.4.0-22.el9_6.5 +2
Fixes 6 records
Priority MEDIUM 57
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0691 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-295
Priority MEDIUM 48
When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00683 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-502
Priority MEDIUM 48
The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00478 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-862
Priority MEDIUM 46
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00683 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-119
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00473 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-704
Priority LOW 39
The RSA and DSA public key parsers did not enforce size limits on key parameters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00467 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-347
THREATIST.IORead the docs