A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade buildahUpgrade criuUpgrade podman-dockerUpgrade python3-podmanUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade podman-gvproxyUpgrade buildah-testsUpgrade slirp4netnsUpgrade skopeoUpgrade fuse-overlayfsUpgrade podman-testsUpgrade runcUpgrade udicaUpgrade toolboxUpgrade toolbox-testsUpgrade netavarkUpgrade podmanUpgrade conmonUpgrade containernetworking-pluginsUpgrade critUpgrade podman-catatonitUpgrade podman-remoteUpgrade crunUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade containers-commonUpgrade skopeo-testsUpgrade libslirpUpgrade libslirp-develUpgrade container-selinuxUpgrade python3-criuUpgrade criu-develUpgrade criu-libs | Feb 10, 2025 | Jan 22, 2025 |
| Alpine Linux | — | Upgrade podmanUpgrade buildah | Aug 8, 2025 | Jan 22, 2025 |
| Debian | — | Upgrade golang-github-containers-buildah | May 15, 2025 | Jan 22, 2025 |
| Oracle_linux | — | Upgrade criu-libsUpgrade podman-catatonitUpgrade podman-remoteUpgrade netavarkUpgrade skopeoUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade runcUpgrade criuUpgrade criu-develUpgrade podmanUpgrade skopeo-testsUpgrade libslirp-develUpgrade critUpgrade cockpit-podmanUpgrade python3-podmanUpgrade libslirpUpgrade podman-testsUpgrade crunUpgrade udicaUpgrade python3-criuUpgrade podman-dockerUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade container-selinuxUpgrade buildah-testsUpgrade buildahUpgrade slirp4netnsUpgrade conmon | Feb 4, 2025 | Jan 20, 2025 |
| Redhat Openshift | — | Upgrade podmanUpgrade buildahUpgrade rhcos | Feb 10, 2025 | Jan 20, 2025 |
| Redhat_linux | — | Upgrade podman-gvproxy-debuginfoUpgrade podman-remoteUpgrade podmanUpgrade buildah-debuginfoUpgrade podman-debuginfoUpgrade podman-dockerUpgrade buildah-testsUpgrade buildahUpgrade podman-testsUpgrade podman-gvproxyUpgrade buildah-debugsourceUpgrade podman-pluginsUpgrade podman-debugsourceUpgrade buildah-tests-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfo | Feb 5, 2025 | Jan 22, 2025 |
| Rocky_linux | — | Upgrade fuse-overlayfs-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade podman-remote-debuginfoUpgrade netavarkUpgrade aardvark-dnsUpgrade criu-debuginfoUpgrade containers-commonUpgrade skopeoUpgrade conmon-debugsourceUpgrade buildah-testsUpgrade runc-debugsourceUpgrade crun-debuginfoUpgrade libslirp-develUpgrade conmonUpgrade buildah-debuginfoUpgrade criu-libsUpgrade crun-debugsourceUpgrade buildah-tests-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criu-debugsourceUpgrade buildahUpgrade toolboxUpgrade fuse-overlayfsUpgrade libslirpUpgrade runc-debuginfoUpgrade podman-remoteUpgrade skopeo-testsUpgrade podmanUpgrade podman-gvproxy-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-pluginsUpgrade toolbox-testsUpgrade runcUpgrade podman-catatonit-debuginfoUpgrade conmon-debuginfoUpgrade slirp4netnsUpgrade slirp4netns-debuginfoUpgrade criuUpgrade python3-criuUpgrade podman-testsUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirp-debugsourceUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade crunUpgrade slirp4netns-debugsourceUpgrade podman-gvproxyUpgrade toolbox-debugsourceUpgrade toolbox-debuginfoUpgrade criu-develUpgrade critUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debugsourceUpgrade podman-catatonitUpgrade containernetworking-plugins-debuginfoUpgrade podman-debuginfoUpgrade criu-libs-debuginfo | Feb 14, 2025 | Jan 22, 2025 |
| Suse | — | Upgrade govulncheck-vulndbUpgrade podmanUpgrade podman-remoteUpgrade podman-dockerUpgrade buildahUpgrade podmansh | Dec 5, 2025 | Feb 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub