CVE-2023-0778

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.(CVE-2022-27649)

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.(CVE-2022-2989)

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.(CVE-2023-0778)

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.(CVE-2022-27649)

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.(CVE-2022-2989)

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.(CVE-2023-0778)

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

• golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

• golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

• podman: symlink exchange attack in podman export volume (CVE-2023-0778)

• golang: crypto/tls: session tickets lack random ticket_age_add (CVE-2022-30629)

• golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

• golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

• golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

• podman: symlink exchange attack in podman export volume (CVE-2023-0778)

• podman: possible information disclosure and modification (CVE-2022-2989)

• golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
• golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)
• golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
• podman: symlink exchange attack in podman export volume (CVE-2023-0778)
• golang: crypto/tls: session tickets lack random ticket_age_add (CVE-2022-30629)
• golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
• golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)
• golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
• podman: symlink exchange attack in podman export volume (CVE-2023-0778)
• podman: possible information disclosure and modification (CVE-2022-2989)
• golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

A Time-of-check Time-of-use (TOCTOU) flaw appears in this version of podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

These are all security issues fixed in the podman-4.4.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for podman fixes the following issues:

Update to version 4.4.4:

• libpod: always use direct mapping
• macos pkginstaller: do not fail when podman-mac-helper fails
• podman-mac-helper: install: do not error if already installed

• podman.spec: Bump required version for libcontainers-common (bsc#1209495)

Update to version 4.4.3:

• compat: /auth: parse server address correctly
• vendor github.com/containers/[email protected]
• pkginstaller: bump Qemu to version 7.2.0
• podman machine: Adjust Chrony makestep config
• [v4.4] fix --health-on-failure=restart in transient unit
• podman logs passthrough driver support --cgroups=split
• journald logs: simplify entry parsing
• podman logs: read journald with passthrough
• journald: remove initializeJournal()
• netavark: only use aardvark ip as nameserver
• compat API: network create return 409 for duplicate
• fix 'podman logs --since --follow' flake
• system service --log-level=trace: support hijack
• podman-mac-helper: exit 1 on error
• bump golang.org/x/net to v0.8.0
• Fix package restore
• Quadlet - use the default runtime

Update podman to version 4.4.2:

• kube play: only enforce passthrough in Quadlet
• Emergency fix for man pages: check for broken includes
• quadlet system tests: add useful defaults, logging
• volume,container: chroot to source before exporting content
• install sigproxy before start/attach
• Update to c/image 5.24.1
• events + container inspect test: RHEL fixes

• Add crun requirement for quadlet

• Set PREFIX at build stage (bsc#1208510)

• CVE-2023-0778: fixed symlink exchange attack in podman export volume (bsc#1208364)

Update to version 4.4.1:

• kube play: do not teardown unconditionally on error
• Resolve symlink path for qemu directory if possible
• events: document journald identifiers
• Quadlet: exit 0 when there are no files to process
• Cleanup podman-systemd.unit file
• Install podman-systemd.unit man page, make quadlet discoverable
• Add missing return after errors
• oci: bind mount /sys with --userns=(auto|pod:)
• docs: specify order preference for FROM
• Cirrus: Fix & remove GraphQL API tests
• test: adapt test to work on cgroupv1
• make hack/markdown-preprocess parallel-safe
• Fix default handling of pids-limit
• system tests: fix volume exec/noexec test

Update to version 4.4.0:

• Do not mount /dev/tty into rootless containers
• Fixes port collision issue on use of --publish-all
• Fix usage of absolute windows paths with --image-path
• fix #17244: use /etc/timezone where timedatectl is missing on Linux
• podman-events: document verbose create events
• Making gvproxy.exe optional for building Windows installer
• Add gvproxy to Windows packages
• Match VT device paths to be blocked from mounting exactly
• Clean up more language for inclusiveness
• Set runAsNonRoot=true in gen kube
• quadlet: Add device support for .volume files
• fix: running check error when podman is default in wsl
• fix: don't output 'ago' when container is currently up and running
• journald: podman logs only show logs for current user
• journald: podman events only show events for current user
• Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml)
• DB: make loading container states optional
• ps: do not sync container
• Allow --device-cgroup-rule to be passed in by docker API
• Cirrus: Update operating branch
• fix APIv2 python attach test flake
• ps: query health check in batch mode
• make example volume import, not import volume
• Correct output when inspecting containers created with --ipc
• Vendor containers/(storage, image, common, buildah)
• Get correct username in pod when using --userns=keep-id
• ps: get network data in batch mode
• build(deps): bump github.com/onsi/gomega from 1.25.0 to 1.26.0
• add hack/perf for comparing two container engines
• systems: retrofit dns options test to honor…

This update for podman fixes the following issues:

Update to version 4.4.4:

• libpod: always use direct mapping
• macos pkginstaller: do not fail when podman-mac-helper fails
• podman-mac-helper: install: do not error if already installed

• podman.spec: Bump required version for libcontainers-common (bsc#1209495)

Update to version 4.4.3:

• compat: /auth: parse server address correctly
• vendor github.com/containers/[email protected]
• pkginstaller: bump Qemu to version 7.2.0
• podman machine: Adjust Chrony makestep config
• [v4.4] fix --health-on-failure=restart in transient unit
• podman logs passthrough driver support --cgroups=split
• journald logs: simplify entry parsing
• podman logs: read journald with passthrough
• journald: remove initializeJournal()
• netavark: only use aardvark ip as nameserver
• compat API: network create return 409 for duplicate
• fix 'podman logs --since --follow' flake
• system service --log-level=trace: support hijack
• podman-mac-helper: exit 1 on error
• bump golang.org/x/net to v0.8.0
• Fix package restore
• Quadlet - use the default runtime

Update to version 4.4.2:

• Revert 'CI: Temporarily disable all AWS EC2-based tasks'
• kube play: only enforce passthrough in Quadlet
• Emergency fix for man pages: check for broken includes
• CI: Temporarily disable all AWS EC2-based tasks
• quadlet system tests: add useful defaults, logging
• volume,container: chroot to source before exporting content
• install sigproxy before start/attach
• Update to c/image 5.24.1
• events + container inspect test: RHEL fixes

• podman.spec: add crun requirement for quadlet

• podman.spec: set PREFIX at build stage (bsc#1208510)

• CVE-2023-0778: Fixed symlink exchange attack in podman export volume (bsc#1208364)

Update to version 4.4.1:

• kube play: do not teardown unconditionally on error
• Resolve symlink path for qemu directory if possible
• events: document journald identifiers
• Quadlet: exit 0 when there are no files to process
• Cleanup podman-systemd.unit file
• Install podman-systemd.unit man page, make quadlet discoverable
• Add missing return after errors
• oci: bind mount /sys with --userns=(auto|pod:)
• docs: specify order preference for FROM
• Cirrus: Fix & remove GraphQL API tests
• test: adapt test to work on cgroupv1
• make hack/markdown-preprocess parallel-safe
• Fix default handling of pids-limit
• system tests: fix volume exec/noexec test

Update to version 4.4.0:

• Emergency fix for RHEL8 gating tests
• Do not mount /dev/tty into rootless containers
• Fixes port collision issue on use of --publish-all
• Fix usage of absolute windows paths with --image-path
• fix #17244: use /etc/timezone where timedatectl is missing on Linux
• podman-events: document verbose create events
• Making gvproxy.exe optional for building Windows installer
• Add gvproxy to Windows packages
• Match VT device paths to be blocked from mounting exactly
• Clean up more language for inclusiveness
• Set runAsNonRoot=true in gen kube
• quadlet: Add device support for .volume files
• fix: running check error when podman is default in wsl
• fix: don't output 'ago' when container is currently up and running
• journald: podman logs only show logs for current user
• journald: podman events only show events for current user
• Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml)
• DB: make loading container states optional
• ps: do not sync container
• Allow --device-cgroup-rule to be passed in by docker API
• Create release notes for v4.4.0
• Cirrus: Update operating branch
• fix APIv2 python attach test flake
• ps: query health check in batch mode
• make example volume import, not import volume
• Correct output when inspecting containers created with --ipc
• Vendor containers/(storage, image, common, buildah)
• Get correct username in pod when using --userns=keep-id…