A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade criu-libsUpgrade skopeo-testsUpgrade container-selinuxUpgrade containernetworking-pluginsUpgrade skopeoUpgrade podmanUpgrade podman-pluginsUpgrade podman-remoteUpgrade python3-podmanUpgrade criu-develUpgrade libslirp-develUpgrade toolboxUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade crunUpgrade podman-catatonitUpgrade toolbox-testsUpgrade buildahUpgrade libslirpUpgrade podman-testsUpgrade podman-gvproxyUpgrade buildah-testsUpgrade conmonUpgrade fuse-overlayfsUpgrade aardvark-dnsUpgrade python3-criuUpgrade criuUpgrade udicaUpgrade runcUpgrade podman-dockerUpgrade cockpit-podmanUpgrade critUpgrade netavarkUpgrade python-podman-apiUpgrade slirp4netns | May 4, 2022 | Apr 4, 2022 |
| Alpine Linux | — | Upgrade podman | Aug 22, 2024 | Apr 4, 2022 |
| Centos_linux | — | Upgrade skopeo-debuginfoUpgrade slirp4netns-debuginfoUpgrade udicaUpgrade criu-develUpgrade podman-debuginfoUpgrade toolbox-debuginfoUpgrade podman-dockerUpgrade runcUpgrade python-podman-apiUpgrade podman-debugsourceUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade crunUpgrade container-selinuxUpgrade crun-debuginfoUpgrade python3-criuUpgrade criu-libs-debuginfoUpgrade libslirp-develUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade runc-debugsourceUpgrade podman-plugins-debuginfoUpgrade libslirp-debugsourceUpgrade podman-gvproxyUpgrade runc-debuginfoUpgrade slirp4netns-debugsourceUpgrade buildah-testsUpgrade podman-remoteUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade crun-debugsourceUpgrade skopeo-testsUpgrade containernetworking-pluginsUpgrade criu-debugsourceUpgrade toolbox-debugsourceUpgrade critUpgrade libslirp-debuginfoUpgrade conmon-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade containers-commonUpgrade fuse-overlayfs-debugsourceUpgrade podman-testsUpgrade podman-pluginsUpgrade buildahUpgrade buildah-tests-debuginfoUpgrade criuUpgrade buildah-debuginfoUpgrade conmonUpgrade conmon-debugsourceUpgrade skopeo-debugsourceUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade toolboxUpgrade libslirpUpgrade podman-catatonit-debuginfoUpgrade podman-catatonitUpgrade python3-podmanUpgrade slirp4netnsUpgrade criu-libsUpgrade buildah-debugsourceUpgrade podmanUpgrade criu-debuginfoUpgrade toolbox-testsUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfsUpgrade containernetworking-plugins-debugsourceUpgrade netavark | Apr 27, 2022 | Apr 4, 2022 |
| Debian | — | Upgrade libpod | Jul 30, 2024 | Apr 4, 2022 |
| Oracle_linux | — | Upgrade podman-gvproxyUpgrade udicaUpgrade cockpit-podmanUpgrade runcUpgrade conmonUpgrade criuUpgrade podman-dockerUpgrade podman-pluginsUpgrade skopeo-testsUpgrade libslirpUpgrade crunUpgrade podman-catatonitUpgrade python3-podmanUpgrade python-podman-apiUpgrade podman-testsUpgrade slirp4netnsUpgrade criu-develUpgrade critUpgrade container-selinuxUpgrade oci-seccomp-bpf-hookUpgrade podmanUpgrade netavarkUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade skopeoUpgrade python3-criuUpgrade fuse-overlayfsUpgrade containers-commonUpgrade criu-libsUpgrade buildahUpgrade aardvark-dnsUpgrade podman-remoteUpgrade buildah-tests | Apr 29, 2022 | Mar 30, 2022 |
| Redhat_linux | — | Upgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-develUpgrade podman-plugins-debuginfoUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade containernetworking-pluginsUpgrade libslirp-debuginfoUpgrade podman-remoteUpgrade slirp4netns-debuginfoUpgrade containers-commonUpgrade buildahUpgrade udicaUpgrade skopeo-testsUpgrade critUpgrade libslirp-debugsourceUpgrade slirp4netns-debugsourceUpgrade container-selinuxUpgrade podman-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade crun-debugsourceUpgrade runc-debuginfoUpgrade conmon-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade criu-libs-debuginfoUpgrade toolbox-debuginfoUpgrade runcUpgrade buildah-testsUpgrade runc-debugsourceUpgrade criu-debugsourceUpgrade python-podman-apiUpgrade podman-debuginfoUpgrade python3-criuUpgrade criu-debuginfoUpgrade fuse-overlayfsUpgrade toolbox-testsUpgrade fuse-overlayfs-debuginfoUpgrade podman-gvproxyUpgrade oci-seccomp-bpf-hookUpgrade python3-podmanUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debuginfoUpgrade criu-libsUpgrade podman-catatonit-debuginfoUpgrade podman-pluginsUpgrade crunUpgrade criuUpgrade netavarkUpgrade conmon-debugsourceUpgrade podmanUpgrade podman-remote-debuginfoUpgrade podman-catatonitUpgrade conmonUpgrade podman-testsUpgrade containernetworking-plugins-debugsourceUpgrade podman-dockerUpgrade buildah-tests-debuginfoUpgrade buildah-debugsourceUpgrade toolboxUpgrade skopeo-debuginfoUpgrade skopeoUpgrade libslirpUpgrade crun-debuginfoUpgrade libslirp-develUpgrade skopeo-debugsource | Apr 20, 2022 | Apr 4, 2022 |
| Rocky_linux | — | Upgrade containernetworking-plugins-debugsourceUpgrade netavarkUpgrade criuUpgrade podman-debugsourceUpgrade podman-gvproxyUpgrade slirp4netns-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade toolbox-testsUpgrade skopeo-testsUpgrade slirp4netns-debugsourceUpgrade libslirpUpgrade slirp4netnsUpgrade crun-debuginfoUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade podman-catatonitUpgrade podman-pluginsUpgrade skopeo-debuginfoUpgrade podmanUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crunUpgrade toolboxUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade conmonUpgrade criu-develUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-testsUpgrade podman-catatonit-debuginfoUpgrade skopeoUpgrade podman-remoteUpgrade runc-debugsourceUpgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade libslirp-debuginfoUpgrade criu-libs-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade runcUpgrade buildahUpgrade fuse-overlayfsUpgrade conmon-debuginfoUpgrade buildah-debuginfoUpgrade skopeo-debugsourceUpgrade crun-debugsourceUpgrade criu-libsUpgrade criu-debugsourceUpgrade containers-commonUpgrade toolbox-debugsourceUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade libslirp-develUpgrade critUpgrade conmon-debugsourceUpgrade buildah-testsUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade aardvark-dnsUpgrade toolbox-debuginfoUpgrade containernetworking-pluginsUpgrade podman-debuginfoUpgrade podman-plugins-debuginfo | Mar 5, 2024 | Apr 4, 2022 |
| Suse | — | Upgrade podman-dockerUpgrade podman-cni-configUpgrade podman-remoteUpgrade podman | Jan 30, 2023 | Apr 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub