CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2022-1227
High (8.8). EPSS 4.2% chance of exploitation in the next 30 days. Fixed in github.com/containers/podman/v3 3.4.
A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.
Severity
- EPSS
- 4.2% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-269, CWE-281
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- podman_project:podman
- psgo_project:psgo
- redhat:developer_tools
- redhat:enterprise_linux
- redhat:enterprise_linux_eus
- redhat:enterprise_linux_for_ibm_z_systems
- redhat:enterprise_linux_for_power_little_endian
- redhat:enterprise_linux_server
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
- redhat:enterprise_linux_server_tus
- redhat:enterprise_linux_server_update_services_for_sap_solutions
- redhat:enterprise_linux_workstation
- redhat:openshift_container_platform
- redhat:quay
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-66vw-v2x9-hw75 | Go | github.com/containers/podman/v3 | <3.4 | 3.4 |
| GHSA-66vw-v2x9-hw75 | Go | github.com/containers/psgo | <1.7.2 | 1.7.2 |
| GO-2022-0558 | Go | github.com/containers/psgo | <1.7.2 | 1.7.2 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2070368
- https://github.com/containers/podman/issues/10941
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/
- https://security.netapp.com/advisory/ntap-20240628-0001/
- https://bugzilla.redhat.com/show_bug.cgi?id=2070368