Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Podman Update Fixes Security Flaw in Container Management

published 2 years ago

Summary

A security issue was found in the way Podman handles container management. This flaw could potentially allow an attacker to compromise the security of your containers and the systems they run on. To fix this issue, update your Podman installation to the latest version.

What to do

Update redhat podman-plugins to version 2:4.4.1-20.el9_2.1.
Update redhat podman-plugins-debuginfo to version 2:4.4.1-20.el9_2.1.
Update redhat podman to version 2:4.4.1-20.el9_2.1.
Update redhat podman-debuginfo to version 2:4.4.1-20.el9_2.1.
Update redhat podman-debugsource to version 2:4.4.1-20.el9_2.1.
Update redhat podman-docker to version 2:4.4.1-20.el9_2.1.
Update redhat podman-gvproxy to version 2:4.4.1-20.el9_2.1.
Update redhat podman-gvproxy-debuginfo to version 2:4.4.1-20.el9_2.1.
Update redhat podman-remote to version 2:4.4.1-20.el9_2.1.
Update redhat podman-remote-debuginfo to version 2:4.4.1-20.el9_2.1.
Update redhat podman-tests to version 2:4.4.1-20.el9_2.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_eus:9.2::appstream	redhat	podman-plugins	< 2:4.4.1-20.el9_2.1 Fix: upgrade to 2:4.4.1-20.el9_2.1
Red Hat:rhel_eus:9.2::appstream	redhat	podman-plugins-debuginfo	< 2:4.4.1-20.el9_2.1 Fix: upgrade to 2:4.4.1-20.el9_2.1
Red Hat:rhel_eus:9.2::appstream	redhat	podman	< 2:4.4.1-20.el9_2.1 Fix: upgrade to 2:4.4.1-20.el9_2.1
Red Hat:rhel_eus:9.2::appstream	redhat	podman-debuginfo	< 2:4.4.1-20.el9_2.1 Fix: upgrade to 2:4.4.1-20.el9_2.1
Red Hat:rhel_eus:9.2::appstream	redhat	podman-debugsource	< 2:4.4.1-20.el9_2.1 Fix: upgrade to 2:4.4.1-20.el9_2.1
Red Hat:rhel_eus:9.2::appstream	redhat	podman-docker	< 2:4.4.1-20.el9_2.1 Fix: upgrade to 2:4.4.1-20.el9_2.1
Red Hat:rhel_eus:9.2::appstream	redhat	podman-gvproxy	< 2:4.4.1-20.el9_2.1 Fix: upgrade to 2:4.4.1-20.el9_2.1
Red Hat:rhel_eus:9.2::appstream	redhat	podman-gvproxy-debuginfo	< 2:4.4.1-20.el9_2.1 Fix: upgrade to 2:4.4.1-20.el9_2.1
Red Hat:rhel_eus:9.2::appstream	redhat	podman-remote	< 2:4.4.1-20.el9_2.1 Fix: upgrade to 2:4.4.1-20.el9_2.1
Red Hat:rhel_eus:9.2::appstream	redhat	podman-remote-debuginfo	< 2:4.4.1-20.el9_2.1 Fix: upgrade to 2:4.4.1-20.el9_2.1
Red Hat:rhel_eus:9.2::appstream	redhat	podman-tests	< 2:4.4.1-20.el9_2.1 Fix: upgrade to 2:4.4.1-20.el9_2.1

Original advisory text

Red Hat Security Advisory: podman security update

References

https://access.redhat.com/errata/RHSA-2024:7820 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2310528 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7820.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-34156 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-34156 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-34156 Vendor Advisory
https://go.dev/cl/611239 Third Party Advisory
https://go.dev/issue/69139 Third Party Advisory
https://groups.google.com/g/golang-dev/c/S9POB9NCTdk Third Party Advisory
https://pkg.go.dev/vuln/GO-2024-3106 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published9 Oct 2024

Updated19 Apr 2026

First seen19 Apr 2026

Sources

RHSA-2024:7820 · OSV

Track software like this

Free during beta