A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade critUpgrade fuse-overlayfsUpgrade runcUpgrade slirp4netnsUpgrade buildah-testsUpgrade podman-dockerUpgrade libslirpUpgrade udicaUpgrade python-podman-apiUpgrade criuUpgrade buildahUpgrade podman-catatonitUpgrade conmonUpgrade toolbox-testsUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade netavarkUpgrade python3-criuUpgrade podman-testsUpgrade podman-gvproxyUpgrade crunUpgrade container-selinuxUpgrade criu-libsUpgrade skopeo-testsUpgrade criu-develUpgrade podman-pluginsUpgrade podman-remoteUpgrade toolboxUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade libslirp-develUpgrade python3-podmanUpgrade skopeoUpgrade podmanUpgrade oci-seccomp-bpf-hook | May 4, 2022 | Apr 4, 2022 |
| Alpine Linux | — | Upgrade podman | Aug 22, 2024 | Apr 4, 2022 |
| Centos_linux | — | Upgrade slirp4netns-debuginfoUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade critUpgrade libslirp-debugsourceUpgrade podman-gvproxyUpgrade runc-debuginfoUpgrade podman-dockerUpgrade python-podman-apiUpgrade podman-debuginfoUpgrade runc-debugsourceUpgrade toolbox-debuginfoUpgrade libslirp-develUpgrade skopeo-debuginfoUpgrade skopeo-testsUpgrade udicaUpgrade crun-debuginfoUpgrade aardvark-dnsUpgrade podman-gvproxy-debuginfoUpgrade container-selinuxUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade runcUpgrade criu-libs-debuginfoUpgrade python3-criuUpgrade cockpit-podmanUpgrade podman-remoteUpgrade podman-debugsourceUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade crunUpgrade containernetworking-plugins-debuginfoUpgrade criu-debugsourceUpgrade conmon-debuginfoUpgrade crun-debugsourceUpgrade criu-develUpgrade libslirp-debuginfoUpgrade slirp4netnsUpgrade toolboxUpgrade python3-podmanUpgrade podman-catatonit-debuginfoUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debugsourceUpgrade containers-commonUpgrade buildah-tests-debuginfoUpgrade buildahUpgrade toolbox-testsUpgrade skopeo-debugsourceUpgrade podman-pluginsUpgrade buildah-debuginfoUpgrade skopeoUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criuUpgrade podman-testsUpgrade criu-libsUpgrade buildah-debugsourceUpgrade conmonUpgrade conmon-debugsourceUpgrade netavarkUpgrade criu-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade podmanUpgrade podman-catatonitUpgrade libslirpUpgrade fuse-overlayfs-debuginfo | Apr 27, 2022 | Apr 4, 2022 |
| Debian | — | Upgrade libpod | Jul 30, 2024 | Apr 4, 2022 |
| Oracle_linux | — | Upgrade containers-commonUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade libslirp-develUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade python3-criuUpgrade podman-remoteUpgrade criu-libsUpgrade buildah-testsUpgrade netavarkUpgrade podmanUpgrade buildahUpgrade podman-gvproxyUpgrade udicaUpgrade runcUpgrade criu-develUpgrade crunUpgrade slirp4netnsUpgrade python-podman-apiUpgrade podman-catatonitUpgrade criuUpgrade critUpgrade python3-podmanUpgrade podman-testsUpgrade libslirpUpgrade skopeo-testsUpgrade podman-dockerUpgrade conmonUpgrade container-selinuxUpgrade podman-pluginsUpgrade cockpit-podman | Apr 29, 2022 | Mar 30, 2022 |
| Redhat_linux | — | Upgrade slirp4netns-debuginfoUpgrade buildahUpgrade podman-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-debugsourceUpgrade skopeo-testsUpgrade containernetworking-plugins-debuginfoUpgrade podman-debuginfoUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade slirp4netns-debugsourceUpgrade criu-libs-debuginfoUpgrade toolbox-debuginfoUpgrade podman-remoteUpgrade criu-debugsourceUpgrade critUpgrade runcUpgrade python-podman-apiUpgrade runc-debugsourceUpgrade libslirp-debuginfoUpgrade aardvark-dnsUpgrade crun-debugsourceUpgrade container-selinuxUpgrade cockpit-podmanUpgrade criu-develUpgrade toolbox-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade python3-criuUpgrade conmon-debuginfoUpgrade containers-commonUpgrade udicaUpgrade fuse-overlayfs-debugsourceUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade podman-gvproxyUpgrade fuse-overlayfsUpgrade criuUpgrade netavarkUpgrade crunUpgrade podmanUpgrade conmon-debugsourceUpgrade buildah-debugsourceUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade buildah-tests-debuginfoUpgrade libslirpUpgrade criu-libsUpgrade buildah-debuginfoUpgrade toolboxUpgrade podman-dockerUpgrade skopeoUpgrade conmonUpgrade podman-catatonitUpgrade toolbox-testsUpgrade podman-testsUpgrade skopeo-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade python3-podmanUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-debuginfoUpgrade crun-debuginfoUpgrade slirp4netnsUpgrade skopeo-debugsourceUpgrade libslirp-devel | Apr 20, 2022 | Apr 4, 2022 |
| Rocky_linux | — | Upgrade podman-remote-debuginfoUpgrade toolbox-debuginfoUpgrade criu-debuginfoUpgrade libslirp-develUpgrade buildah-testsUpgrade critUpgrade toolbox-debugsourceUpgrade conmon-debugsourceUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade buildahUpgrade aardvark-dnsUpgrade podman-remoteUpgrade runc-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade criu-debugsourceUpgrade criu-libsUpgrade runcUpgrade crun-debugsourceUpgrade fuse-overlayfsUpgrade conmon-debuginfoUpgrade skopeo-debugsourceUpgrade buildah-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-debuginfoUpgrade containernetworking-pluginsUpgrade buildah-tests-debuginfoUpgrade libslirp-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-debugsourceUpgrade podmanUpgrade podman-testsUpgrade podman-gvproxyUpgrade criuUpgrade slirp4netns-debuginfoUpgrade libslirpUpgrade skopeo-debuginfoUpgrade podman-catatonitUpgrade crunUpgrade toolboxUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade netavarkUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debugsourceUpgrade slirp4netnsUpgrade slirp4netns-debugsourceUpgrade podman-pluginsUpgrade skopeoUpgrade skopeo-testsUpgrade podman-catatonit-debuginfoUpgrade toolbox-testsUpgrade fuse-overlayfs-debuginfoUpgrade crun-debuginfoUpgrade criu-develUpgrade conmonUpgrade runc-debuginfoUpgrade libslirp-debugsource | Mar 5, 2024 | Apr 4, 2022 |
| Suse | — | Upgrade podman-remoteUpgrade podman-cni-configUpgrade podman-dockerUpgrade podman | Jan 30, 2023 | Apr 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub