Link following in podman
Priority LOW 32CWE-59Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 2 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-59 and the CVSS impact.
Summary
A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00865 58th percentileScored 2026-11-07
Fix Partial github.com/containers/podman/v4 (Go): 4.5.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | podman | Podman 4.3.0 | — | No fix listed | CNA |
| — | github.com/containers/podman/v4 (Go) | before 4.5.0 | 4.5.0 | Patch available | GHSA-4crw-w8pw-2hmf |
- podman Vendor— Affected Podman 4.3.0 Fixed in — No fix listed CNA
- github.com/containers/podman/v4 (Go) Vendor— Affected before 4.5.0 Fixed in 4.5.0 Patch available GHSA-4crw-w8pw-2hmf
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:podman_project:podman:4.3.0:-:*:*:*:*:*:* | 4.3.0 | Vulnerable | Podman Project |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
- cpe:2.3:a:podman_project:podman:4.3.0:-:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Podman Project
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-4crw-w8pw-2hmf github.com/containers/podman/v4 (Go) Fixed in 4.5.0 Advisory →
Red Hat 2 advisories
- RHSA-2024:9102 Released 2024-11-12 · Red Hat rating Moderatepodman security update
- Red Hat Enterprise Linux AppStream (v. 9) podman-2:5.2.2-1.el9, podman-docker-2:5.2.2-1.el9, podman-plugins-2:5.2.2-1.el9 +2
- RHSA-2024:2077 Released 2024-04-29 · Red Hat rating Importantcontainer-tools:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+21741+dd5be1e7.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+21741+dd5be1e7.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+21741+dd5be1e7.s390x::container-tools:rhel8 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | — |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:9102 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:2077 |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4122
- 2026-10-03 Alias added: GHSA-4crw-w8pw-2hmf
References
Sources
- CVE-2022-4122 · CVE Program
- CVE-2022-4122 · NVD
- FIRST EPSS
- GHSA-4crw-w8pw-2hmf · GitHub Advisory Database · CC BY 4.0
- CVE-2022-4122 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences