Read the docs
TI-2022-02760 Aliases CVE-2022-2989GHSA-4wjj-jwc9-2x96

Incorrect authorization in podman

Priority LOW 33CWE-842Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00326 25th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial github.com/containers/podman/v4 (Go): 4.2.0github.com/containers/podman/v3 (Go): 3.0.1Red Hat: 5 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—podmanno fixed version known—No fix listedCNA
—github.com/containers/podman/v4 (Go)before 4.2.04.2.0Patch availableGHSA-4wjj-jwc9-2x96
—github.com/containers/podman/v3 (Go)before 3.0.13.0.1Patch availableGHSA-4wjj-jwc9-2x96
  • podman Vendor— Affected no fixed version known Fixed in — No fix listed CNA
  • github.com/containers/podman/v4 (Go) Vendor— Affected before 4.2.0 Fixed in 4.2.0 Patch available GHSA-4wjj-jwc9-2x96
  • github.com/containers/podman/v3 (Go) Vendor— Affected before 3.0.1 Fixed in 3.0.1 Patch available GHSA-4wjj-jwc9-2x96

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:*all versionsVulnerablePodman Project
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*3.11VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
  • cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Podman Project
  • cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-4wjj-jwc9-2x96 github.com/containers/podman/v4 (Go) Fixed in 4.2.0 Advisory →
  • Fix · GHSA-4wjj-jwc9-2x96 github.com/containers/podman/v3 (Go) Fixed in 3.0.1 Advisory →

Red Hat 5 advisories

  • RHSA-2023:3613 Released 2023-06-26 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.22 packages and security update
    • Red Hat OpenShift Container Platform 4.12 bpftool-4.18.0-372.59.1.el8_6, buildah-1:1.23.4-5.1.rhaos4.12.el8, buildah-1:1.23.4-5.rhaos4.12.el9 +47
  • RHSA-2023:2802 Released 2023-05-16 · Red Hat rating Moderate
    container-tools:4.0 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.s390x::container-tools:4.0 +47
  • RHSA-2022:8431 Released 2022-11-15 · Red Hat rating Low
    podman security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.2.0-7.el9_1, podman-catatonit-2:4.2.0-7.el9_1, podman-docker-2:4.2.0-7.el9_1 +4
Show 2 more Red Hat advisories
  • RHSA-2022:8008 Released 2022-11-15 · Red Hat rating Moderate
    buildah security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.27.0-2.el9, buildah-tests-1:1.27.0-2.el9
  • RHSA-2022:7822 Released 2022-11-08 · Red Hat rating Low
    container-tools:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.1.0-5.module+el8.7.0+17064+3b31f55c.aarch64::container-tools:rhel8, aardvark-dns-2:1.1.0-5.module+el8.7.0+17064+3b31f55c.ppc64le::container-tools:rhel8, aardvark-dns-2:1.1.0-5.module+el8.7.0+17064+3b31f55c.s390x::container-tools:rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:7822, RHSA-2023:2802
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:8008, RHSA-2022:8431
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2023:3613
Not affected: 1 product
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2989
  2. 2026-10-03 Alias added: GHSA-4wjj-jwc9-2x96

References

Exploit 2

Advisory 1

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences