A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade udicaUpgrade python3-criuUpgrade aardvark-dnsUpgrade podman-testsUpgrade podman-catatonitUpgrade cockpit-podmanUpgrade conmonUpgrade podman-gvproxyUpgrade python-podman-apiUpgrade criuUpgrade critUpgrade libslirpUpgrade fuse-overlayfsUpgrade buildahUpgrade podman-dockerUpgrade toolbox-testsUpgrade runcUpgrade netavarkUpgrade slirp4netnsUpgrade buildah-testsUpgrade podman-pluginsUpgrade toolboxUpgrade podman-remoteUpgrade criu-libsUpgrade container-selinuxUpgrade criu-develUpgrade crunUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade libslirp-develUpgrade skopeo-testsUpgrade python3-podmanUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade skopeo | May 4, 2022 | Apr 4, 2022 |
| Alpine Linux | — | Upgrade podman | Aug 22, 2024 | Apr 4, 2022 |
| Centos_linux | — | Upgrade libslirp-develUpgrade podman-plugins-debuginfoUpgrade toolbox-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade skopeo-testsUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade runc-debugsourceUpgrade cockpit-podmanUpgrade podman-remoteUpgrade criu-develUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade critUpgrade podman-dockerUpgrade criu-debugsourceUpgrade podman-gvproxyUpgrade slirp4netns-debugsourceUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade podman-debugsourceUpgrade skopeo-debuginfoUpgrade buildah-testsUpgrade crun-debugsourceUpgrade toolbox-debuginfoUpgrade runcUpgrade python-podman-apiUpgrade podman-gvproxy-debuginfoUpgrade python3-criuUpgrade podman-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netns-debuginfoUpgrade conmon-debuginfoUpgrade crunUpgrade aardvark-dnsUpgrade container-selinuxUpgrade crun-debuginfoUpgrade udicaUpgrade podman-pluginsUpgrade podman-testsUpgrade buildah-debuginfoUpgrade criu-libsUpgrade python3-podmanUpgrade podman-catatonit-debuginfoUpgrade libslirpUpgrade podmanUpgrade criu-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonitUpgrade toolboxUpgrade skopeoUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criuUpgrade conmonUpgrade conmon-debugsourceUpgrade slirp4netnsUpgrade buildah-debugsourceUpgrade containers-commonUpgrade buildahUpgrade fuse-overlayfsUpgrade containernetworking-plugins-debugsourceUpgrade netavarkUpgrade toolbox-testsUpgrade skopeo-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfo | Apr 27, 2022 | Apr 4, 2022 |
| Debian | — | Upgrade libpod | Jul 30, 2024 | Apr 4, 2022 |
| Oracle_linux | — | Upgrade skopeo-testsUpgrade python3-podmanUpgrade podman-catatonitUpgrade conmonUpgrade podman-dockerUpgrade criuUpgrade podman-gvproxyUpgrade podman-testsUpgrade cockpit-podmanUpgrade crunUpgrade python-podman-apiUpgrade podman-pluginsUpgrade slirp4netnsUpgrade container-selinuxUpgrade runcUpgrade udicaUpgrade criu-develUpgrade critUpgrade libslirpUpgrade buildahUpgrade fuse-overlayfsUpgrade containers-commonUpgrade podmanUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade aardvark-dnsUpgrade buildah-testsUpgrade netavarkUpgrade criu-libs | Apr 29, 2022 | Mar 30, 2022 |
| Redhat_linux | — | Upgrade slirp4netns-debugsourceUpgrade conmon-debuginfoUpgrade crun-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-plugins-debuginfoUpgrade container-selinuxUpgrade buildahUpgrade containernetworking-plugins-debuginfoUpgrade criu-libs-debuginfoUpgrade skopeo-testsUpgrade podman-debuginfoUpgrade runc-debuginfoUpgrade criu-debugsourceUpgrade toolbox-debuginfoUpgrade runc-debugsourceUpgrade critUpgrade python-podman-apiUpgrade aardvark-dnsUpgrade containernetworking-pluginsUpgrade libslirp-debuginfoUpgrade containers-commonUpgrade slirp4netns-debuginfoUpgrade runcUpgrade podman-debugsourceUpgrade udicaUpgrade cockpit-podmanUpgrade criu-develUpgrade toolbox-debugsourceUpgrade python3-criuUpgrade podman-gvproxy-debuginfoUpgrade buildah-testsUpgrade podman-remoteUpgrade libslirp-debugsourceUpgrade skopeoUpgrade podman-dockerUpgrade podman-catatonit-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podman-gvproxyUpgrade toolboxUpgrade skopeo-debuginfoUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade python3-podmanUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade podman-remote-debuginfoUpgrade skopeo-debugsourceUpgrade libslirp-develUpgrade criu-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netnsUpgrade crun-debuginfoUpgrade buildah-debuginfoUpgrade criu-libsUpgrade libslirpUpgrade criuUpgrade conmonUpgrade toolbox-testsUpgrade buildah-tests-debuginfoUpgrade podman-testsUpgrade fuse-overlayfsUpgrade conmon-debugsourceUpgrade crunUpgrade podmanUpgrade netavark | Apr 20, 2022 | Apr 4, 2022 |
| Rocky_linux | — | Upgrade skopeo-debugsourceUpgrade buildah-debuginfoUpgrade criu-libsUpgrade criu-debugsourceUpgrade podman-debuginfoUpgrade buildah-tests-debuginfoUpgrade containernetworking-pluginsUpgrade crun-debugsourceUpgrade libslirp-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade toolbox-debugsourceUpgrade criu-libs-debuginfoUpgrade aardvark-dnsUpgrade fuse-overlayfs-debugsourceUpgrade podman-plugins-debuginfoUpgrade runc-debugsourceUpgrade fuse-overlayfsUpgrade conmon-debuginfoUpgrade buildahUpgrade runcUpgrade python3-criuUpgrade buildah-testsUpgrade containers-commonUpgrade podman-remote-debuginfoUpgrade conmon-debugsourceUpgrade critUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade toolbox-debuginfoUpgrade podman-remoteUpgrade criu-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirp-debugsourceUpgrade toolboxUpgrade runc-debuginfoUpgrade crun-debuginfoUpgrade toolbox-testsUpgrade buildah-debugsourceUpgrade skopeo-debuginfoUpgrade podman-catatonitUpgrade libslirpUpgrade fuse-overlayfs-debuginfoUpgrade conmonUpgrade skopeo-testsUpgrade slirp4netns-debuginfoUpgrade criuUpgrade podman-testsUpgrade podman-gvproxyUpgrade podmanUpgrade podman-debugsourceUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade crunUpgrade slirp4netns-debugsourceUpgrade netavarkUpgrade containernetworking-plugins-debugsourceUpgrade skopeoUpgrade criu-develUpgrade podman-pluginsUpgrade podman-catatonit-debuginfo | Mar 5, 2024 | Apr 4, 2022 |
| Suse | — | Upgrade podman-cni-configUpgrade podman-remoteUpgrade podman-dockerUpgrade podman | Jan 30, 2023 | Apr 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub