{"id":"CVE-2024-9407","aliases":["ALPINE-CVE-2024-9407","ALSA-2024:8846","ALSA-2024:9051","ALSA-2024:9454","ALSA-2024:9459","AZL-108011","AZL-50262","AZL-50268","BELL-CVE-2024-9407","CLSA-2025-1756932191","CLSA-2025-1764692266","DEBIAN-CVE-2024-9407","EUVD-2024-3036","GHSA-fhqq-8f65-5xfc","GO-2024-3169","MGASA-2024-0343","OESA-2025-1053","OESA-2025-1055","OESA-2025-2257","OESA-2025-2258","OESA-2025-2259","OESA-2025-2297","RHSA-2024:8846","RHSA-2024:9051","RHSA-2024:9454","RHSA-2024:9459","RHSA-2024:9926","RLSA-2024:9051","SUSE-SU-2024:3545-1","SUSE-SU-2024:3741-1","SUSE-SU-2024:3911-1","SUSE-SU-2024:3988-1","SUSE-SU-2024:4303-1","SUSE-SU-2025:0267-1","SUSE-SU-2025:0319-1","SUSE-SU-2025:0320-1","SUSE-SU-2025:0775-1","SUSE-SU-2025:20080-1","SUSE-SU-2025:20143-1","SUSE-SU-2025:20279-1","UBUNTU-CVE-2024-9407","openSUSE-SU-2024:0350-1","openSUSE-SU-2024:14388-1","openSUSE-SU-2024:14390-1","openSUSE-SU-2024:14447-1"],"status":"published","title":"Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction","description":"A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00288,"percentile":0.21466,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2024-10-01T20:13:29Z","modified":"2026-11-05T21:16:19Z","fixes":[{"ecosystem":"Go","package":"github.com/containers/buildah","fixed_in":["1.37.4"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/containers/podman/v5","fixed_in":["5.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/containers/podman","fixed_in":["5.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/containers/podman/v2","fixed_in":["5.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/containers/podman/v3","fixed_in":["5.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/containers/podman/v4","fixed_in":["5.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.20","package":"buildah","fixed_in":["1.37.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"buildah","fixed_in":["1.37.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"buildah","fixed_in":["1.37.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"buildah","fixed_in":["1.37.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"buildah","fixed_in":["1.37.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"podman","fixed_in":["5.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"podman","fixed_in":["5.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"podman","fixed_in":["5.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"podman","fixed_in":["5.2.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"podman","fixed_in":["5.2.4-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"podman","fixed_in":["5.6.1-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"buildah","fixed_in":["1.37.5-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"podman","fixed_in":["5.2.5-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"buildah","fixed_in":["1.37.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"containers-common","fixed_in":["0.60.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"podman","fixed_in":["5.2.4-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah","fixed_in":["1:1.35.4-1.el9_2.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah-tests","fixed_in":["1:1.35.4-1.el9_2.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-github-containers-buildah","fixed_in":["1.37.4+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-containers-buildah","fixed_in":["1.37.4+ds1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/containers/buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.37.3"},{"fixed":"1.37.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/containers/podman/v5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.2.3"},{"fixed":"5.2.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/containers/podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.2.3"},{"fixed":"5.2.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/containers/podman/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.2.3"},{"fixed":"5.2.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/containers/podman/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.2.3"},{"fixed":"5.2.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/containers/podman/v4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.2.3"},{"fixed":"5.2.4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aardvark-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aardvark-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.1-2.module_el8.10.0+3901+4b80ecd7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.10-1.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.10-1.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"84.1-1.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"conmon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.10-1.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"conmon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.10-1.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"conmon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.10-1.module_el8.10.0+3901+4b80ecd7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"conmon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.10-1.module_el8.10.0+3845+87b84552"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"container-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.229.0-2.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-5.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-5.module_el8.10.0+3901+4b80ecd7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-5.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1-82.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1-82.module_el8.10.0+3901+4b80ecd7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3901+4b80ecd7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3845+87b84552"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3845+87b84552"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3845+87b84552"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3845+87b84552"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3901+4b80ecd7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.3-2.module_el8.10.0+3845+87b84552"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.3-2.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.3-2.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-1.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-1.module_el8.10.0+3792+03eaed9c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-1.module_el8.10.0+3901+4b80ecd7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-2.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-2.module_el8.10.0+3845+87b84552"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-2.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-2.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-2.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-2.module_el8.10.0+3845+87b84552"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-2.module_el8.10.0+3901+4b80ecd7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"netavark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.3-1.module_el8.10.0+3901+4b80ecd7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"netavark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.3-1.module_el8.10.0+3845+87b84552"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"netavark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.3-1.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-seccomp-bpf-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-1.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-seccomp-bpf-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-1.module_el8.10.0+3792+03eaed9c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-seccomp-bpf-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-1.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3901+4b80ecd7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-2.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.12-5.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.5-3.module_el8.10.0+3901+4b80ecd7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.5-3.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.5-3.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.5-3.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.5-3.module_el8.10.0+3901+4b80ecd7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1.module_el8.10.0+3845+87b84552"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1.module_el8.10.0+3901+4b80ecd7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.5-2.module_el8.10.0+3901+4b80ecd7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.5-2.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.5-2.module_el8.10.0+3845+87b84552"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.5-2.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.5-2.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.5-2.module_el8.10.0+3909+6e1c1eb7"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"udica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.6-21.module_el8.10.0+3876+e55593a8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-16.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-16.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-16.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-16.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-16.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.2-9.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.2-9.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.2-9.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.2-9.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.2-9.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.37.5-1.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.37.5-1.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Azure Linux:3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.43.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.1-26"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0-r1"},{"fixed":"1.37.5-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1-r0"},{"fixed":"5.2.5-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.31.0-r0"},{"fixed":"1.37.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.52.0-r0"},{"fixed":"0.60.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.1-r1"},{"fixed":"5.2.4-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.4-1.el9_2.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.4-1.el9_2.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.6-1.el9_2.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.6-1.el9_2.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-containers-buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.28.2+ds1-3","1.28.2+ds1-3+deb12u1","1.29.0+ds1-1","1.30.0+ds1-1","1.30.0+ds1-2","1.30.0+ds1-3","1.31.2+ds1-1","1.31.2+ds1-2","1.31.2+ds1-3","1.32.0+ds1-1","1.32.0+ds1-2","1.32.2+ds1-1","1.33.1+ds1-1","1.33.1+ds1-2","1.33.3+ds1-1","1.33.3+ds1-2","1.33.5+ds1-3","1.33.5+ds1-4","1.33.7+ds1-1","1.34.0+ds1-1","1.34.0+ds1-2","1.35.3+ds1-1","1.35.3+ds1-2","1.35.3+ds1-3","1.37.0+ds1-1","1.37.1+ds1-1","1.37.1+ds1-2","1.37.2+ds1-1","1.37.2+ds1-2","1.37.2+ds1-3","1.37.3+ds1-1","1.37.3+ds1-2","1.37.3+ds1-3","1.37.4+ds1-1","1.37.5+ds1-1","1.38.0+ds1-1","1.38.0+ds1-2","1.38.1+ds1-1","1.39.0+ds1-1","1.39.3+ds1-1","1.41.4+ds1-1","1.41.4+ds1-2","1.41.4+ds1-3","1.41.5+ds1-1","1.41.5+ds1-2","1.41.5+ds1-3","1.41.5+ds1-4","1.42.1+ds1-1","1.42.1+ds1-2","1.43.0+ds1-1","1.43.0+ds1-2","1.43.1+ds1-1","1.43.1+ds1-2","1.43.1+ds1-3","1.43.2+ds1-1","1.43.2+ds1-2","1.43.2+ds1-3","1.45.0+ds1-1","1.45.0+ds1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-containers-buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.4+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-containers-buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.4+ds1-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containers/buildah","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.37.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containers/podman/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containers/podman","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containers/podman/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containers/podman/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containers/podman/v4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containers/buildah","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.37.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containers/podman","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containers/podman/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containers/podman/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containers/podman/v4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containers/podman/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.4"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.4-1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4-13.oe2403"}]}],"bundled":13},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4-13.oe2403sp1"}]}],"bundled":13},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-10.oe2403sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-10.oe2403"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.1-10.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-7.oe2203sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aardvark-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.1-2.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.10-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.10-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.10-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.10-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.10-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:84.1-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"conmon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.10-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"conmon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.10-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"conmon-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.10-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"container-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.229.0-2.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-5.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-5.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-5.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1-82.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.3-2.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"crun-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.3-2.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"crun-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.3-2.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-2.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libslirp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-2.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libslirp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-2.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libslirp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-2.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"netavark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.3-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-seccomp-bpf-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.10-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-seccomp-bpf-hook-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.10-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-seccomp-bpf-hook-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.10-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-catatonit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-15.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0-2.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0-2.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.12-5.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.12-5.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.12-5.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.5-3.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.5-3.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-1.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.99.5-2.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"toolbox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.99.5-2.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"toolbox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.99.5-2.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"toolbox-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.99.5-2.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"udica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.6-21.module+el8.10.0+22397+e3c95ba6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-16.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-16.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-16.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-16.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-16.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-16.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-16.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-16.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-16.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.2-9.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.2-9.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.2-9.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.2-9.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.2-9.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.2-9.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.2-9.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.2-9.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.2.2-9.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.37.5-1.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.37.5-1.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.37.5-1.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.37.5-1.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.37.5-1.el9_5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.11-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.11-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.11-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.11-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.11-1.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-16.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.4-150500.3.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.4-150500.3.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.4-150500.3.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.4-150500.3.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.5","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150500.3.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241030T212825-150000.1.9.1"}]}],"bundled":44},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241030T212825-150000.1.9.1"}]}],"bundled":44},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241030T212825-150000.1.9.1"}]}],"bundled":44},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241030T212825-150000.1.9.1"}]}],"bundled":44},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.4-150400.3.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.4-150400.3.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.4-150400.3.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.4-150400.3.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.4-150300.8.28.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.4-150300.8.28.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.4-150300.8.28.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.4-150300.8.28.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.35.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.35.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.35.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.35.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.35.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150400.4.35.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150400.3.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150300.8.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150300.8.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150300.8.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.5-150300.8.31.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.43.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.43.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.43.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.43.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.43.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-150300.9.43.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-slfo.1.1_1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-containers-buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.3+ds1-1ubuntu1","1.23.1+ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"golang-github-containers-buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.28.2+ds1-3build1","1.32.2+ds1-1","1.33.1+ds1-2","1.33.3+ds1-2","1.33.5+ds1-4","1.33.5+ds1-4build1","1.33.5+ds1-4build2","1.33.7+ds1-1","1.33.7+ds1-1ubuntu0.24.04.1","1.33.7+ds1-1ubuntu0.24.04.2","1.33.7+ds1-1ubuntu0.24.04.2+esm1","1.33.7+ds1-1ubuntu0.24.04.2+esm2","1.33.7+ds1-1ubuntu0.24.04.3","1.33.7+ds1-1ubuntu0.24.04.3+esm2","1.33.7+ds1-1ubuntu0.24.04.3+esm3"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241104T154416-5.1"}]}],"bundled":56},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.4-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241030T212825-1.1"}]}],"bundled":44}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 extended update support"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.16"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:10147","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8846","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9051","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9454","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9459","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9926","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-9407","tags":["vdb-entry","x_refsource_REDHAT","report","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2315887","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://github.com/advisories/GHSA-fhqq-8f65-5xfc","tags":["advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20241220-0010/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9407","tags":["web","advisory"]},{"url":"https://github.com/containers/podman/releases/tag/v5.2.4","tags":["web"]},{"url":"https://github.com/containers/buildah/commit/e4e2ad5ca2088d7c388109394135ead7aaf1f4f4","tags":["web","fix","report"]},{"url":"https://pkg.go.dev/vuln/GO-2024-3169","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20241220-0010","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-9407","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-9341","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-9675","tags":["report"]},{"url":"https://bugzilla.redhat.com/2315691","tags":["report"]},{"url":"https://bugzilla.redhat.com/2315887","tags":["report"]},{"url":"https://bugzilla.redhat.com/2317458","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-8846.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-9676","tags":["report"]},{"url":"https://bugzilla.redhat.com/2317467","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9051.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-34155","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-34156","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-34158","tags":["report"]},{"url":"https://bugzilla.redhat.com/2310527","tags":["report"]},{"url":"https://bugzilla.redhat.com/2310528","tags":["report"]},{"url":"https://bugzilla.redhat.com/2310529","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9454.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9459.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-9407","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1756932191.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1764692266.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9407.json","tags":["advisory"]},{"url":"https://github.com/containers/buildah","tags":["package"]},{"url":"https://github.com/containers/podman","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-9407","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0343.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33036","tags":["report"]},{"url":"https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf","tags":["advisory"]},{"url":"https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYT3D2P3OJKISNFKOOHGY6HCUCQZYAVR/","tags":["web"]},{"url":"https://lwn.net/Articles/978101/","tags":["web"]},{"url":"https://lwn.net/Articles/978102/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2024-July/018858.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/PJ4RBOYLRKSRUVS77S4OAZ7SQJWH36K2/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/MYMA7BZJZTURAPGKHV2ACU3HBJTKVYMK/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9514","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2880","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24791","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37298","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6104","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9341","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9355","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9676","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1055","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45337","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2258","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27144","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2259","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11218","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22869","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2315691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317458","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8846.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-9341","tags":["advisory"]},{"url":"https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L169","tags":["article"]},{"url":"https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L349","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-9407","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-9675","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317467","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9051.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-9676","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wq2p-5pc6-wpgf","tags":["advisory"]},{"url":"https://github.com/containers/storage/commit/935c58f4b3e364a9c9d33ed06476a831e6ad5679","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2310527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2310528","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2310529","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-60263","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-61249","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9454.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-34155","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34155","tags":["advisory"]},{"url":"https://go.dev/cl/611238","tags":["article"]},{"url":"https://go.dev/issue/69138","tags":["article"]},{"url":"https://groups.google.com/g/golang-dev/c/S9POB9NCTdk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-3105","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-34156","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34156","tags":["advisory"]},{"url":"https://go.dev/cl/611239","tags":["article"]},{"url":"https://go.dev/issue/69139","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-3106","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-34158","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34158","tags":["advisory"]},{"url":"https://go.dev/cl/611240","tags":["article"]},{"url":"https://go.dev/issue/69141","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-3107","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-62107","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9459.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9926.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9051","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243545-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1231208","tags":["report"]},{"url":"https://bugzilla.suse.com/1231230","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9407","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243741-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214612","tags":["report"]},{"url":"https://bugzilla.suse.com/1231499","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9675","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243911-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-33662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9594","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243988-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1231698","tags":["report"]},{"url":"https://bugzilla.suse.com/1232522","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9676","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244303-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250267-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215807","tags":["report"]},{"url":"https://bugzilla.suse.com/1215926","tags":["report"]},{"url":"https://bugzilla.suse.com/1217828","tags":["report"]},{"url":"https://bugzilla.suse.com/1221677","tags":["report"]},{"url":"https://bugzilla.suse.com/1236270","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-1753","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250319-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236272","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250320-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250775-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227052","tags":["report"]},{"url":"https://bugzilla.suse.com/1236507","tags":["report"]},{"url":"https://bugzilla.suse.com/1237641","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27144","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520080-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520143-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520279-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224112","tags":["report"]},{"url":"https://bugzilla.suse.com/1239330","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-9407","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8185","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SH4NME65WLYSIYI2S73LD7TJVOL5XNUR/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4W2RFBCCEXD7IMZ5BZTZHSWFFZ7ALKG6/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-9407","title":"Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction","description":"A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.","status":"published","published":"2024-10-01T20:13:29.588Z","modified":"2026-11-05T14:45:14.627Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2024-3036","description":"A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.","status":"published","published":"2024-10-01T20:13:29Z","modified":"2026-11-05T14:45:14Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T16:59:57.067043Z"}],"ghsa":[{"id":"GHSA-fhqq-8f65-5xfc","title":"Improper Input Validation in Buildah and Podman","description":"A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.","status":"published","published":"2024-10-01T21:31:35Z","modified":"2024-12-20T15:30:48Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:25.334027Z"}],"nvd":[{"id":"CVE-2024-9407","description":"A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.","status":"published","published":"2024-10-01T21:15:08.53Z","modified":"2026-11-05T15:17:03.58Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-05T19:55:50.758755Z"}],"osv":[{"id":"ALPINE-CVE-2024-9407","description":"A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.","status":"published","published":"2024-10-01T21:15:08.53Z","modified":"2026-11-03T06:32:12.667623527Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"BELL-CVE-2024-9407","status":"published","published":"2024-10-02T05:56:41.541121Z","modified":"2026-01-26T09:41:20.00094Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2024-9407","title":"Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction","description":"A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.","status":"published","published":"2024-10-01T20:13:29.588Z","modified":"2026-11-07T02:30:35.73045374Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-07T03:07:55.264406Z"},{"id":"DEBIAN-CVE-2024-9407","description":"A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.","status":"published","published":"2024-10-01T21:15:08.53Z","modified":"2026-11-02T12:03:12.754956753Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"GHSA-fhqq-8f65-5xfc","title":"Improper Input Validation in Buildah and Podman","description":"A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.","status":"published","published":"2024-10-01T21:31:35Z","modified":"2026-09-10T03:50:19.726228798Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","level":"medium"},{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"OESA-2025-1053","title":"podman security update","description":"Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.\r\n\r\nSecurity Fix(es):\r\n\r\nSome HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514)\r\n\r\nUncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962)\r\n\r\nRequests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request\u0026apos;s Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880)\r\n\r\nA too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.(CVE-2022-32189)\r\n\r\nPrograms which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.(CVE-2022-41715)\r\n\r\nThe net/http HTTP/1.1 client mishandled the case where a server responds to a request with an \u0026quot;Expect: 100-continue\u0026quot; header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending \u0026quot;Expect: 100-continue\u0026quot; requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.(CVE-2024-24791)\r\n\r\ngorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.(CVE-2024-37298)\r\n\r\ngo-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.(CVE-2024-6104)\r\n\r\nA flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.(CVE-2024-9341)\r\n\r\nA vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.(CVE-2024-9355)\r\n\r\nA vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.(CVE-2024-9407)\r\n\r\nA vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.(CVE-2024-9675)\r\n\r\nA vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.(CVE-2024-9676)","status":"published","published":"2025-01-17T11:08:08Z","modified":"2026-08-18T01:18:44.98208219Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1055","title":"podman security update","description":"Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.\r\n\r\nSecurity Fix(es):\r\n\r\nSome HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514)\r\n\r\nUncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962)\r\n\r\nRequests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request\u0026apos;s Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880)\r\n\r\nA too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.(CVE-2022-32189)\r\n\r\nPrograms which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.(CVE-2022-41715)\r\n\r\nThe net/http HTTP/1.1 client mishandled the case where a server responds to a request with an \u0026quot;Expect: 100-continue\u0026quot; header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending \u0026quot;Expect: 100-continue\u0026quot; requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.(CVE-2024-24791)\r\n\r\ngorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.(CVE-2024-37298)\r\n\r\ngo-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.(CVE-2024-6104)\r\n\r\nA flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.(CVE-2024-9341)\r\n\r\nA vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.(CVE-2024-9355)\r\n\r\nA vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.(CVE-2024-9407)\r\n\r\nA vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.(CVE-2024-9675)\r\n\r\nA vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.(CVE-2024-9676)","status":"published","published":"2025-01-17T11:08:08Z","modified":"2026-08-18T01:18:45.210988845Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-2257","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nApplications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \u0026quot;A call to this function does not guarantee that the key offered is in fact used to authenticate.\u0026quot; Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/(CVE-2024-45337)\n\nA flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.(CVE-2024-9341)\n\nA vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.(CVE-2024-9407)","status":"published","published":"2025-09-12T11:09:20Z","modified":"2026-08-18T01:19:09.4814701Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2258","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nApplications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \u0026quot;A call to this function does not guarantee that the key offered is in fact used to authenticate.\u0026quot; Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/(CVE-2024-45337)\n\nA flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.(CVE-2024-9341)\n\nA vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.(CVE-2024-9407)\n\nGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \u0026quot;.\u0026quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)","status":"published","published":"2025-09-12T11:09:20Z","modified":"2026-08-18T01:19:10.865304986Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2259","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nApplications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \u0026quot;A call to this function does not guarantee that the key offered is in fact used to authenticate.\u0026quot; Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/(CVE-2024-45337)\n\nA flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.(CVE-2024-9341)\n\nA vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.(CVE-2024-9407)","status":"published","published":"2025-09-12T11:09:20Z","modified":"2026-08-18T01:19:10.783534831Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2297","title":"buildah security update","description":"The  package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container\u0026amp;apos;s root file system for manipulation * save container\u0026amp;apos;s root file system layer to create a new image * delete a working container or an image\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.(CVE-2024-11218)\n\nApplications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \u0026quot;A call to this function does not guarantee that the key offered is in fact used to authenticate.\u0026quot; Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/(CVE-2024-45337)\n\nA flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.(CVE-2024-9341)\n\nA vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.(CVE-2024-9407)\n\nSSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.(CVE-2025-22869)\n\nGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \u0026quot;.\u0026quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)","status":"published","published":"2025-09-19T11:09:22Z","modified":"2026-08-18T01:19:10.313388708Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"RHSA-2024:8846","title":"Red Hat Security Advisory: container-tools:rhel8 security update","status":"published","published":"2024-11-13T15:26:55Z","modified":"2026-10-14T10:05:36Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:9051","title":"Red Hat Security Advisory: podman security update","status":"published","published":"2024-11-13T21:19:55Z","modified":"2026-10-14T10:05:42Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:9454","title":"Red Hat Security Advisory: podman security update","status":"published","published":"2024-11-13T21:19:29Z","modified":"2026-10-17T10:04:28Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:9459","title":"Red Hat Security Advisory: buildah security update","status":"published","published":"2024-11-13T21:19:39Z","modified":"2026-10-17T10:04:29Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:9926","title":"Red Hat Security Advisory: buildah security update","status":"published","published":"2024-11-25T09:53:37Z","modified":"2026-10-14T10:05:52Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"UBUNTU-CVE-2024-9407","description":"A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.","status":"published","published":"2024-10-01T21:15:00Z","modified":"2026-03-25T19:21:34.768579Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"ALSA-2024:8846","title":"Important: container-tools:rhel8 security update","description":"The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.  \n\nSecurity Fix(es):  \n\n  * Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (CVE-2024-9341)\n  * Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)\n  * buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-11-05T00:00:00Z","modified":"2026-10-29T11:02:22.142993512Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2024:9051","title":"Important: podman security update","description":"The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  \n\nSecurity Fix(es):  \n\n  * Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)\n  * buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)\n  * Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-11-11T00:00:00Z","modified":"2026-10-29T11:31:50.575632348Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2024:9454","title":"Important: podman security update","description":"The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  \n\nSecurity Fix(es):  \n\n  * go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)\n  * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)\n  * go/build/constraint: golang: Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)\n  * Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (CVE-2024-9341)\n  * Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)\n  * buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)\n  * Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:53.208428182Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2024:9459","title":"Important: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.   \n\nSecurity Fix(es):  \n\n  * go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)\n  * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)\n  * go/build/constraint: golang: Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)\n  * Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (CVE-2024-9341)\n  * Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)\n  * buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)\n  * Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:52.999434163Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-108011","title":"CVE-2024-9407 affecting package buildah 1.43.1-3","description":"A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.","status":"published","published":"2024-10-01T21:15:08Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"AZL-50262","title":"CVE-2024-9407 affecting package podman for versions less than 5.6.1-2","description":"A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.","status":"published","published":"2024-10-01T21:15:08Z","modified":"2026-04-21T04:56:11.337002Z","updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"AZL-50268","title":"CVE-2024-9407 affecting package podman 4.1.1-26","description":"A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.","status":"published","published":"2024-10-01T21:15:08Z","modified":"2026-04-21T04:30:10.476156Z","updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"CLSA-2025-1756932191","title":"buildah: Fix of CVE-2024-9407","description":"- CVE-2024-9407: validate input for bind-propagation option in Dockerfile RUN\n  --mount instruction to prevent arbitrary parameter passing and potential file\n  modification","status":"published","published":"2025-09-03T20:43:15Z","modified":"2026-06-01T00:30:59.352087347Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1764692266","title":"buildah: Fix of 4 CVEs","description":"- Update buildah to 1.39.6\n- CVE-2025-52881: fix runc vulnerability by updating to runc v1.2.8\n- Update golang dependency to 1.22.9.tuxcare.els1\n- Remove patches for fixes included in upstream (CVE-2024-9341, CVE-2024-9407,\n  CVE-2025-27144)","status":"published","published":"2025-12-02T16:17:50Z","modified":"2026-10-21T10:46:19.422833441Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"GO-2024-3169","title":"Improper Input Validation in Buildah and Podman in github.com/containers/buildah","description":"Improper Input Validation in Buildah and Podman in github.com/containers/buildah","status":"published","published":"2024-10-09T20:29:23Z","modified":"2026-02-04T03:01:05.09801Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"MGASA-2024-0343","title":"Updated buildah, podman, skopeo packages fix security vulnerabilities","description":"A flaw was found in Buildah (and subsequently Podman Build) which allows\ncontainers to mount arbitrary locations on the host filesystem into\nbuild containers. A malicious Containerfile can use a dummy image with a\nsymbolic link to the root filesystem as a mount source and cause the\nmount operation to mount the host root filesystem inside the RUN step.\nThe commands inside the RUN step will then have read-write access to the\nhost filesystem, allowing for full container escape at build time.\n(CVE-2024-1753)\nA flaw was found in the github.com/containers/image library. This flaw\nallows attackers to trigger unexpected authenticated registry accesses\non behalf of a victim user, causing resource exhaustion, local path\ntraversal, and other attacks. (CVE-2024-3727)\nWhen parsing a multipart form (either explicitly with\nRequest.ParseMultipartForm or implicitly with Request.FormValue,\nRequest.PostFormValue, or Request.FormFile), limits on the total size of\nthe parsed form were not applied to the memory consumed while reading a\nsingle form line. This permits a maliciously crafted input containing\nvery long lines to cause allocation of arbitrarily large amounts of\nmemory, potentially leading to memory exhaustion. With fix, the\nParseMultipartForm function now correctly limits the maximum size of\nform lines. (CVE-2023-45290)\nPackage jose aims to provide an implementation of the Javascript Object\nSigning and Encryption set of standards. An attacker could send a JWE\ncontaining compressed data that used large amounts of memory and CPU\nwhen decompressed by Decrypt or DecryptMulti. Those functions now return\nan error if the decompressed data would exceed 250kB or 10x the\ncompressed size (whichever is larger). This vulnerability has been\npatched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)\njose is JavaScript module for JSON Object Signing and Encryption,\nproviding support for JSON Web Tokens (JWT), JSON Web Signature (JWS),\nJSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),\nand more. A vulnerability has been identified in the JSON Web Encryption\n(JWE) decryption interfaces, specifically related to the support for\ndecompressing plaintext after its decryption. Under certain conditions\nit is possible to have the user's environment consume unreasonable\namount of CPU time or memory during JWE Decryption operations. This\nissue has been patched in versions 2.0.7 and 4.15.5. (CVE-2024-28176)\nA flaw was found in Go. When FIPS mode is enabled on a system, container\nruntimes may incorrectly handle certain file paths due to improper\nvalidation in the containers/common Go library. This flaw allows an\nattacker to exploit symbolic links and trick the system into mounting\nsensitive host directories inside a container. This issue also allows\nattackers to access critical host files, bypassing the intended\nisolation between containers and the host system. (CVE-2024-9341)\ngo-retryablehttp prior to 0.7.7 did not sanitize urls when writing them\nto its log file. This could lead to go-retryablehttp writing sensitive\nHTTP basic auth credentials to its log file. This vulnerability,\nCVE-2024-6104, was fixed in go-retryablehttp 0.7.7. (CVE-2024-6104)\nA vulnerability exists in the bind-propagation option of the Dockerfile\nRUN --mount instruction. The system does not properly validate the input\npassed to this option, allowing users to pass arbitrary parameters to\nthe mount instruction. This issue can be exploited to mount sensitive\ndirectories from the host into a container during the build process and,\nin some cases, modify the contents of those mounted files. Even if\nSELinux is used, this vulnerability can bypass its protection by\nallowing the source directory to be relabeled to give the container\naccess to host files. (CVE-2024-9407)\n","status":"published","published":"2024-11-01T17:26:56Z","modified":"2026-04-16T04:42:47.733556802Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:0350-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww\n  * GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97\n  * GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r\n  * GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch\n  * GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq\n  * GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw\n  * GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h\n  * GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh\n  * GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj\n\n- Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g\n  * GO-2024-3245 CVE-2024-39720\n  * GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v\n\n- Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm\n  * GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh\n\n- Update to version 0.0.20241030T160108 2024-10-30T16:01:08Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr\n  * GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c\n  * GO-2024-3228 GHSA-wcx9-ccpj-hx3c\n- Packaging improvments:\n  * Backfill CVE aliases in recent changelog entries\n\n- Update to version 0.0.20241028T152002 2024-10-28T15:20:02Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3207 GHSA-p5wf-cmr4-xrwr\n  * GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6\n  * GO-2024-3210 CVE-2024-8901\n  * GO-2024-3211 CVE-2024-50312\n  * GO-2024-3212 GHSA-rjfv-pjvx-mjgv\n  * GO-2024-3213 CVE-2024-49380\n  * GO-2024-3214 CVE-2024-49381\n  * GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7\n  * GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv\n  * GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc\n  * GO-2024-3219 GHSA-7h65-4p22-39j6\n  * GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4\n  * GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc\n  * GO-2024-3222 GHSA-x7xj-jvwp-97rv\n  * GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v\n  * GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r\n\n- Update to version 0.0.20241017T153730 date 2024-10-17T15:37:30Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3203 CVE-2024-9486\n  * GO-2024-3204 CVE-2024-9594\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc\n  * GO-2024-3199 GHSA-vv6c-69r6-chg9\n  * GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj\n  * GO-2024-3201 CVE-2023-22644\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4\n  * GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3\n  * GO-2024-3163 CVE-2024-47182\n  * GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52\n  * GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h\n  * GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc\n  * GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4\n  * GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8\n  * GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4\n  * GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x\n  * GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq\n  * GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr\n  * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787\n  * GO-2024-3182 GHSA-wpr2-j6gr-pjw9\n  * GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m\n  * GO-2024-3185 CVE-2024-47832\n  * GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp\n  * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2\n  * GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226\n  * GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j","status":"published","published":"2024-11-05T14:52:20Z","modified":"2026-02-04T12:23:04.839834Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:14388-1","title":"buildah-1.37.4-1.1 on GA media","description":"These are all security issues fixed in the buildah-1.37.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-08T00:00:00Z","modified":"2026-02-04T04:13:31.084383Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14390-1","title":"podman-5.2.4-1.1 on GA media","description":"These are all security issues fixed in the podman-5.2.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-08T00:00:00Z","modified":"2026-02-04T04:18:45.839422Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14447-1","title":"govulncheck-vulndb-0.0.20241030T212825-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20241030T212825-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-01T00:00:00Z","modified":"2026-02-04T03:23:32.319637Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"RLSA-2024:9051","title":"Important: podman security update","description":"The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.\n\nSecurity Fix(es):\n\n* Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)\n\n* buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)\n\n* Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-11-19T16:02:24.506028Z","modified":"2026-02-04T07:40:21.505154Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2024:3545-1","title":"Security update for buildah","description":"This update for buildah fixes the following issues:\n\n- CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (bsc#1231208).\n- CVE-2024-9341: Fixed FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library in cri-o (nsc#1231230).\n","status":"published","published":"2024-10-08T14:04:20Z","modified":"2026-02-04T02:39:40.3349Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3741-1","title":"Security update for podman","description":"This update for podman fixes the following issues:\n\n- CVE-2024-9675: Fixed cache arbitrary directory mount (bsc#1231499).\n- CVE-2024-9407: Fixed improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (bsc#1231208).\n\nThe following non-security bug was fixed:\n\n- rootless ipv6 containers can't be started (bsc#1214612).\n","status":"published","published":"2024-10-21T12:33:42Z","modified":"2026-02-04T04:12:55.59741Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3911-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nUpdate to version 0.0.20241030T212825 2024-10-30T21:28:25Z ( jsc#PED-11136 )\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm\n  * GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr\n  * GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c\n  * GO-2024-3228 GHSA-wcx9-ccpj-hx3c\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3207 GHSA-p5wf-cmr4-xrwr\n  * GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6\n  * GO-2024-3210 CVE-2024-8901\n  * GO-2024-3211 CVE-2024-50312\n  * GO-2024-3212 GHSA-rjfv-pjvx-mjgv\n  * GO-2024-3213 CVE-2024-49380\n  * GO-2024-3214 CVE-2024-49381\n  * GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7\n  * GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv\n  * GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc\n  * GO-2024-3219 GHSA-7h65-4p22-39j6\n  * GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4\n  * GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc\n  * GO-2024-3222 GHSA-x7xj-jvwp-97rv\n  * GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v\n  * GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3203 CVE-2024-9486\n  * GO-2024-3204 CVE-2024-9594\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc\n  * GO-2024-3199 GHSA-vv6c-69r6-chg9\n  * GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj\n  * GO-2024-3201 CVE-2023-22644\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6\n\n- Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4\n  * GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3\n  * GO-2024-3163 CVE-2024-47182\n  * GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52\n  * GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h\n  * GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc\n  * GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4\n  * GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8\n  * GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4\n  * GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x\n  * GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq\n  * GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr\n  * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787\n  * GO-2024-3182 GHSA-wpr2-j6gr-pjw9\n  * GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m\n  * GO-2024-3185 CVE-2024-47832\n  * GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp\n  * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2\n  * GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226\n  * GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j","status":"published","published":"2024-11-05T07:45:02Z","modified":"2026-02-05T08:02:05.10845Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3988-1","title":"Security update for buildah","description":"\nThis update for buildah fixes the following issues:\n\n- CVE-2024-9676: Fixed github.com/containers/storage: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (bsc#1231698):\n- CVE-2024-9675: VUL-0: CVE-2024-9675: buildah,podman: buildah: cache arbitrary directory mount (bsc#1231499):\n- CVE-2024-9407: Fixed improper input validation in bind-propagation Option of Dockerfile RUN --mount Instruction (bsc#1231208)\n- CVE-2024-9341: Fixed FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (bsc#1231230)\n\n- Using networking slirp4netns as default instead of pasta on SLE (bsc#1232522).\n\n","status":"published","published":"2024-11-14T10:13:27Z","modified":"2026-02-04T03:05:33.11756Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:4303-1","title":"Security update for buildah","description":"This update for buildah fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2024-9675: cache arbitrary directory mount (bsc#1231499)\n- CVE-2024-9407: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (bsc#1231208)\n- CVE-2024-9676: symlink traversal vulnerability in the containers/storage library can cause denial of service (bsc#1231698)\n- CVE-2024-9341: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (bsc#1231230)\n\nNon-security issue fixed:\n\n- default to slirp4netns on SLE instead of pasta (bsc#1232522)\n","status":"published","published":"2024-12-12T12:50:22Z","modified":"2026-02-04T03:58:57.810449Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0267-1","title":"Security update for podman","description":"\nThis update for podman fixes the following issues:\n\n- CVE-2024-9676: github.com/containers/storage: Fixed symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (bsc#1231698) \n\n- Load ip_tables and ip6_tables kernel module (bsc#1214612)\n  * Required for rootless mode as a regular user has no permission\n    to load kernel modules\n\n- CVE-2024-9675: Fixed cache arbitrary directory mount in buildah (bsc#1231499)\n- CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction in buildah (bsc#1231208)\n- CVE-2024-9341: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (bsc#1231230)\n- CVE-2024-1753: Fixed full container escape at build time in buildah (bsc#1221677)\n- CVE-2024-11218: Fixed a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. (bsc#1236270)\n\n- Refactor network backend dependencies:\n  * podman requires either netavark or cni-plugins. On ALP, require\n    netavark, otherwise prefer netavark but don't force it.\n  * This fixes missing cni-plugins in some scenarios\n  * Default to netavark everywhere where it's available\n","status":"published","published":"2025-01-28T11:25:30Z","modified":"2026-02-04T02:50:11.674465Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:0319-1","title":"Security update for buildah","description":"This update for buildah fixes the following issues:\n\n- Update to version 1.35.5 \n- CVE-2024-11218: Fix TOCTOU error when bind and cache mounts use 'src' values. (bsc#1236272)\n","status":"published","published":"2025-02-01T09:53:09Z","modified":"2026-02-04T04:39:15.603728Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:0320-1","title":"Security update for buildah","description":"This update for buildah fixes the following issues:\n\n- Update to version 1.35.5 \n- CVE-2024-11218: Fix TOCTOU error when bind and cache mounts use 'src' values. (bsc#1236272)\n","status":"published","published":"2025-02-01T09:53:55Z","modified":"2026-02-04T02:26:50.138257Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:0775-1","title":"Security update for podman","description":"\nThis update for podman fixes the following issues:\n\n- CVE-2025-27144: Fixed denial of service in parsing function of embedded library Go JOSE (bsc#1237641)\n- CVE-2024-9676: github.com/containers/storage: Fixed symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (bsc#1231698) \n- CVE-2024-9675: Fixed cache arbitrary directory mount in buildah (bsc#1231499)\n- CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction in buildah (bsc#1231208)\n- CVE-2024-9341: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (bsc#1231230)\n- CVE-2024-1753: Fixed full container escape at build time in buildah (bsc#1221677)\n- CVE-2024-11218: Fixed a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. (bsc#1236270)\n- CVE-2024-6104: Fixed hashicorp/go-retryablehttp writing sensitive information to log files (bsc#1227052)\n- CVE-2023-45288: Fixed golang.org/x/net/http2 excessive resource consumption when receiving too many headers (bsc#1236507)\n  \n\n- Load ip_tables and ip6_tables kernel module (bsc#1214612)\n  * Required for rootless mode as a regular user has no permission\n    to load kernel modules\n\n\n- Refactor network backend dependencies:\n  * podman requires either netavark or cni-plugins. On ALP, require\n    netavark, otherwise prefer netavark but don't force it.\n  * This fixes missing cni-plugins in some scenarios\n  * Default to netavark everywhere where it's available\n","status":"published","published":"2025-03-04T12:51:39Z","modified":"2026-02-04T03:34:30.220181Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:20080-1","title":"Security update for podman","description":"This update for podman fixes the following issues:\n\n- CVE-2024-9676: Fixed a denial of service via a symlink traversal in the containers/storage library (bsc#1231698)\n- CVE-2024-9341: Fixed FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (bsc#1231230)\n- CVE-2024-9675: Fixed caching of arbitrary directory mount (bsc#1231499)\n- CVE-2024-9407: Fixed improper input validation in bind-propagation option of Dockerfile RUN --mount instruction (bsc#1231208)\n","status":"published","published":"2025-02-03T09:06:00Z","modified":"2026-03-23T04:48:09.24077Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20143-1","title":"Security update for podman","description":"This update for podman fixes the following issues:\n\n- CVE-2025-27144: Fixed gopkg.in/square/go-jose.v2,gopkg.in/go-jose/go-jose.v2,github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237641):\n- CVE-2024-11218: Fixed github.com/containers/buildah: Container breakout by using --jobs=2 and a race condition when building a malicious Containerfile  (bsc#1236270):\n- CVE-2023-45288: Fixed golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236507):\n- CVE-2024-6104: Fixed hashicorp/go-retryablehttp: url might write sensitive information to log file  (bsc#1227052):\n\n","status":"published","published":"2025-03-12T10:31:01Z","modified":"2026-03-23T04:50:03.956229Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20279-1","title":"Security update for podman","description":"This update for podman fixes the following issues:\n\n- CVE-2023-45288: Fixed closing connection when receiving too many headers (bsc#1236507).\n- CVE-2024-11218: Fixed container breakout by using --jobs=2 and a race condition when building a malicious Containerfile (bsc#1236270).\n- CVE-2025-22869: Fixed Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239330).\n- CVE-2025-27144: Fixed Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237641).\n- CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (bsc#1231208).\n- CVE-2024-3727: Fixed digest type (bsc#1224112).\n- CVE-2024-1753: Fixed full container escape at build time (bsc#1221677). \n\nOther fixes:\n- Updated to version 5.2.5:\n  * RPM: remove dup Provides\n  * Packit: constrain koji and bodhi jobs to fedora package to avoid dupes\n  * Validate the bind-propagation option to `--mount`\n  * Updated Buildah to v1.37.4\n  * vendor: updated c/common to v0.60.4\n  * pkg/specgen: allow pasta when running inside userns\n  * libpod: convert owner IDs only with :idmap\n  * allow exposed sctp ports\n  * libpod: setupNetNS() correctly mount netns\n  * vendor: updated c/common to v0.60.3\n  * [skip-ci] Packit: split out ELN jobs and reuse fedora downstream targets\n  * [skip-ci] Packit: Enable sidetags for bodhi updates\n  * Updated gvisor-tap-vsock to 0.7.5\n  * CI: podman-machine: do not use cache registry\n  * [CI:DOCS] Add v5.2.2 lib updates to RELEASE_NOTES.md\n  * Update RELEASE_NOTES for v5.2.2\n  * [v5.2] Bump Buildah to v1.37.2, c/common v0.60.2, c/image v5.32.2\n  * [v5.2] golangci-lint: make darwin linting happy\n  * [v5.2] golangci-lint: make windows linting happy\n  * [v5.2] test/e2e: remove kernel version check\n  * [v5.2] golangci-lint: remove most skip dirs\n  * [v5.2] set !remote build tags where needed\n  * [v5.2] update golangci-lint to 1.60.1\n  * Packit: update targets for propose-downstream\n  * Create volume path before state initialization\n  * Update Cirrus DEST_BRANCH\n  * Bump to v5.2.2-dev\n  * Bump to v5.2.1\n  * Update release notes for v5.2.1\n  * [v5.2] Add zstd:chunked test fix\n  * [v5.2] Bump Buildah to v1.37.1, c/common v0.60.1, c/image v5.32.1\n  * libpod: reset state error on init\n  * libpod: do not save expected stop errors in ctr state\n  * libpod: fix broken saveContainerError()\n  * Bump to v5.2.1-dev\n  * Bump to v5.2.0\n  * Never skip checkout step in release workflow\n  * Bump to v5.2.0-dev\n  * Bump to v5.2.0-rc3\n  * Update release notes for v5.2.0-rc3\n  * Tweak versions in register_images.go\n  * fix network cleanup flake in play kube\n  * WIP: Fixes for vendoring Buildah\n  * Add --compat-volumes option to build and farm build\n  * Bump Buildah, c/storage, c/image, c/common\n  * libpod: bind ports before network setup\n  * pkg/api: do not leak config pointers into specgen\n  * build: Update gvisor-tap-vsock to 0.7.4\n  * test/system: fix borken pasta interface name checks\n  * test/system: fix bridge host.containers.internal test\n  * CI: system tests: instrument to allow failure analysis\n  * Use uploaded .zip for Windows action\n  * RPM: podman-iptables.conf only on Fedora\n  * Bump to v5.2.0-dev\n  * Bump to v5.2.0-rc2\n  * Update release notes for v5.2.0-rc2\n  * test/e2e: fix ncat tests\n  * libpod: add hidden env to set sqlite timeout\n  * Add support for StopSignal in quadlet .container files\n  * podman pod stats: fix race when ctr process exits\n  * Update module github.com/vbauerster/mpb/v8 to v8.7.4\n  * libpod: correctly capture healthcheck output\n  * Bump bundled krunkit to 0.1.2\n  * podman stats: fix race when ctr process exists\n  * nc -p considered harmful\n  * podman pod stats: fix pod rm race\n  * podman ps: fix racy pod name query\n  * system connection remove: use Args function to validate\n  * pkg/machine/compression: skip decompress bar for empty file\n  * nc -p considered harmful\n  * podman system df: fix fix ErrNoSuchCtr/Volume race\n  * podman auto-update: fix ErrNoSuchCtr race\n  * Fix name for builder in farm connection\n  * 700-play.bats: use unique pod/container/image/volume names\n  * safename: consistent within same test, and, dashes\n  * 700-kube.bats: refactor $PODMAN_TMPDIR/test.yaml\n  * 700-play.bats: eliminate $testYaml\n  * 700-play.bats: refactor clumsy yamlfile creation\n  * 700-play.bats: move _write_test_yaml up near top\n  * chore(deps): update dependency setuptools to v71\n  * Expand drop-in search paths * top-level (pod.d) * truncated (unit-.container.d)\n  * Remove references and checks for --gpus\n  * Do not crash on invalid filters\n  * fix(deps): update module github.com/rootless-containers/rootlesskit/v2 to v2.2.0\n  * Bump to v5.2.0-dev\n  * Bump to v5.2.0-rc1\n  * Keep the volume-driver flag deprecated\n  * Vendor in latest containers(common, storage,image, buildah)\n  * System tests: safe container/image/volume/etc names\n  * Implement disable default mounts via command line\n  * test: drop unmount for overlay\n  * test: gracefully terminate server\n  * libpod: shutdown Stop waits for handlers completion\n  * libpod: cleanup store at shutdown\n  * Add NetworkAlias= support to quadlet\n  * cmd: call shutdown handler stop function\n  * fix race conditions in start/attach logic\n  * swagger: exlude new docker network types\n  * vendor: bump c/storage\n  * update to docker 27\n  * contrib: use a distinct --pull-option= for each flag\n  * Update warning message when using external compose provider\n  * Update module github.com/cyphar/filepath-securejoin to v0.3.0\n  * Ignore result of EvalSymlinks on ENOENT\n  * test/upgrade: fix tests when netavark uses nftables\n  * test/system: fix network reload test with nftables\n  * test/e2e: rework some --expose tests\n  * test: remove publish tests from e2e\n  * CI: test nftables driver on fedora\n  * CI: use local registry, part 3 of 3: for developers\n  * CI: use local registry, part 2 of 3: fix tests\n  * CI: use local registry, part 1 of 3: setup\n  * CI: test composefs on rawhide\n  * chore(deps): update module google.golang.org/grpc to v1.64.1 [security]\n  * chore(deps): update dependency setuptools to ~=70.3.0\n  *  Improve container filenname ambiguity.\n  * containers/attach: Note bug around goroutine leak\n  * Drop minikube CI test\n  * add libkrun test docs\n  * fix(deps): update module tags.cncf.io/container-device-interface to v0.8.0\n  * cirrus: check for header files in source code check\n  * pkg/machine/e2e: run debug command only for macos\n  * create runtime's worker queue before queuing any job\n  * test/system: fix pasta host.containers.internal test\n  * Visual Studio BuildTools as a MinGW alternative\n  * SetupRootless(): only reexec when needed\n  * pkg/rootless: simplify reexec for container code\n  * cirrus: add missing test/tools to danger files\n  * fix(deps): update module golang.org/x/tools to v0.23.0\n  * Windows Installer: switch to wix5\n  * fix(deps): update module golang.org/x/net to v0.27.0\n  * pkg/machine/e2e: print tests timings at the end\n  * pkg/machine/e2e: run debug commands after init\n  * pkg/machine/e2e: improve timeout handling\n  * libpod: first delete container then cidfile\n  * fix(deps): update module golang.org/x/term to v0.22.0\n  * System test fixes\n  * cirrus.yml: automatic skips based on source\n  * fix(deps): update module github.com/containers/ocicrypt to v1.2.0\n  * podman events: fix error race\n  * chore(deps): update dependency setuptools to ~=70.2.0\n  * fix(deps): update module github.com/gorilla/schema to v1.4.1 [security]\n  * Update CI VM images\n  * pkg/machine/e2e: fix broken cleanup\n  * pkg/machine/e2e: use tmp file for connections\n  * test/system: fix podman --image-volume to allow tmpfs storage\n  * CI: mount tmpfs for container storage\n  * docs: --network remove missing leading sentence\n  * specgen: parse devices even with privileged set\n  * vendor: update c/storage\n  * Remove the unused machine volume-driver\n  * feat(quadlet): log option handling\n  * Error when machine memory exceeds system memory\n  * machine: Always use --log-file with gvproxy\n  * CI: Build-Each-Commit test: run only on PRs\n  * Small fixes for testing libkrun\n  * Podman machine resets all providers\n  * Clearly indicate names w/ URLencoded duplicates\n  * [skip-ci] Packit: split rhel and centos-stream jobs\n  * apple virtiofs: fix racy mount setup\n  * cirrus: fix broken macos artifacts URL\n  * libpod/container_top_linux.c: fix missing header\n  * refactor(build): improve err when file specified by -f does not exist\n  * Minor: Remove unhelpful comment\n  * Update module github.com/openshift/imagebuilder to v1.2.11\n  * Minor: Rename the OSX Cross task\n  * [skip-ci] Remove conditionals from changelog\n  * podman top: join the container userns\n  * Run linting in parallel with building\n  * Fix missing Makefile target dependency\n  * build API: accept platform comma separated\n  * [skip-ci] RPM: create podman-machine subpackage\n  * ExitWithError() - more upgrades from Exit()\n  * test/e2e: remove podman system service tests\n  * cirrus: reduce int tests timeout\n  * cirrus: remove redundant skip logic\n  * pkg/machine/apple: machine stop timeout\n  * CI: logformatter: link to correct PR base\n  * Update module github.com/crc-org/crc/v2 to v2.38.0\n  * ExitWithError(): continued\n  * test/system: Add test steps for journald log check in quadlet\n  * restore: fix missing network setup\n  * podman run use pod userns even with --pod-id-file\n  * macos-installer: bundle krunkit\n  * remote API: fix pod top error reporting\n  * libpod API: return proper error status code for pod start\n  * fix #22233\n  * added check for `registry.IsRemote()`. and correct error message.\n  * fix #20686\n  * pkg/machine/e2e: Remove unnecessary copy of machine image.\n  * libpod: intermediate mount if UID not mapped into the userns\n  * libpod: avoid chowning the rundir to root in the userns\n  * libpod: do not chmod bind mounts\n  * libpod: unlock the thread if possible\n  * CI Cleanup: Remove cgroups v1 support\n  * ExitWithError() - more upgrades from Exit()\n  * remote: fix incorrect CONTAINER_CONNECTION parsing\n  * container: pass KillSignal and StopTimeout to the systemd scope\n  * libpod: fix comment\n  * e2e: test container restore in pod by name\n  * docs: Adds all PushImage supported paramters to openapi docs.\n  * systests: kube: bump up a timeout\n  * cirrus.yml: add CI:ALL mode to force all tests\n  * cirrus.yml: implement skips based on source changes\n  * CI VMs: bump\n  * restore: fix container restore into pod\n  * sqlite_state: Fix RewriteVolumeConfig\n  * chore(deps): update dependency setuptools to ~=70.1.0\n  * Quadlet - use specifier for unescaped values for templated container name\n  * cirrus: check for system test leaks in nightly\n  * test/system: check for leaks in teardown suite\n  * test/system: speed up basic_{setup,teardown}()\n  * test/system: fix up many tests that do not cleanup\n  * test/system: fix podman --authfile=nonexistent-path\n  * Update module github.com/containernetworking/plugins to v1.5.1\n  * Update module github.com/checkpoint-restore/checkpointctl to v1.2.1\n  * Update module github.com/spf13/cobra to v1.8.1\n  * Update module github.com/gorilla/schema to v1.4.0\n  * pkg/machine/wsl: force terminate wsl instance\n  * pkg/machine/wsl: wrap command errors\n  * [CI:DOCS] Quadlet - add note about relative path resolution\n  * CI: do not install python packages at runtime\n  * Release workflow: Include candidate descriptor\n  * Minor: Fix indentation in GHA release workflow\n  * GHA: Send release notification mail\n  * GHA: Validate release version number\n  * Remove references to --pull=true and --pull=false\n  * ExitWithError, continued\n  * podman: add new hidden flag --pull-option\n  * [CI:DOCS] Fix typos in podman-build\n  * infra: mark storageSet when imagestore is changed\n  * [CI:DOCS] Add jnovy as reviewer and approver\n  * fix(deps): update module google.golang.org/protobuf to v1.34.2\n  * refactor(machine,wsl): improve operations of Windows API\n  * --squash --layers=false should be allowed\n  * fix(deps): update module github.com/checkpoint-restore/checkpointctl to v1.2.0\n  * update golangci-lint to v1.59.1\n  * Rename master to main in CONTRIBUTING.md\n  * podman 5, pasta and inter-container networking\n  * libpod: do not resuse networking on start\n  * machine/linux: Switch to virtiofs by default\n  * machine/linux: Support virtiofs mounts (retain 9p default)\n  * machine/linux: Use memory-backend-memfd by default\n  * ExitWithError() - continued\n  * Enable libkrun provider to open a debug console\n  * Add new targets on Windows makefile (winmake.ps1)\n  * fix(deps): update module github.com/docker/docker to v26.1.4+incompatible\n  * fix(deps): update module github.com/crc-org/crc/v2 to v2.37.1\n  * fix(deps): update module golang.org/x/tools to v0.22.0\n  * fix(deps): update module golang.org/x/net to v0.26.0\n  * libpod: fix 'podman kube generate' on FreeBSD\n  * fix(deps): update module golang.org/x/sys to v0.21.0\n  * libpod: do not leak systemd hc startup unit timer\n  * vendor latest c/common\n  * pkg/rootless: set _CONTAINERS_USERNS_CONFIGURED correctly\n  * run bats -T, to profile timing hogs\n  * test/system: speed up podman ps --external\n  * test/system: speed up podman network connect/disconnect\n  * test/system: speed up podman network reload\n  * test/system: speed up quadlet - pod simple\n  * test/system: speed up podman parallel build should not race\n  * test/system: speed up podman cp dir from host to container\n  * test/system: speed up podman build - workdir, cmd, env, label\n  * test/system: speed up podman --log-level recognizes log levels\n  * test/system: remove obsolete debug in net connect/disconnect test\n  * test/system: speed up quadlet - basic\n  * test/system: speed up user namespace preserved root ownership\n  * System tests: add `podman system check` tests\n  * Add `podman system check` for checking storage consistency\n  * fix(deps): update module github.com/crc-org/crc/v2 to v2.37.0\n  * fix(libpod): add newline character to the end of container's hostname file\n  * fix(deps): update module github.com/openshift/imagebuilder to v1.2.10\n  * fix(deps): update github.com/containers/image/v5 digest to aa93504\n  * Fix 5.1 release note re: runlabel\n  * test/e2e: use local skopeo not image\n  * fix(deps): update golang.org/x/exp digest to fd00a4e\n  * [CI:DOCS] Add contrib/podmanimage/stable path back in repo\n  * chore(deps): update dependency requests to ~=2.32.3\n  * fix(deps): update github.com/containers/image/v5 digest to 2343e81\n  * libpod: do not move podman with --cgroups=disabled\n  * Update release notes on Main to v5.1.0\n  * test: look at the file base name\n  * tests: simplify expected output\n  * Sigh, new VMs again\n  * Fail earlier when no containers exist in stats\n  * Add Hyper-V option in windows installer\n  * libpod: cleanup default cache on system reset\n  * vendor: update c/image\n  * test/system: speed up kube generate tmpfs on /tmp\n  * test/system: speed up podman kube play tests\n  * test/system: speed up podman shell completion test\n  * test/system: simplify test signal handling in containers\n  * test/system: speed up podman container rm ...\n  * test/system: speed up podman ps - basic tests\n  * test/system: speed up read-only from containers.conf\n  * test/system: speed up podman logs - multi ...\n  * test/system: speed up podman run --name\n  * Debian: switch to crun\n  * test/system: speed up podman generate systemd - envar\n  * test/system: speed up podman-kube@.service template\n  * test/system: speed up kube play healthcheck initialDelaySeconds\n  * test/system: speed up exit-code propagation test\n  * test/system: speed up \"podman run --timeout\"\n  * test/system: fix slow kube play --wait with siginterrupt\n  * undo auto-formatting\n  * test/system: speed up podman events tests\n  * Quadlet: Add support for .build files\n  * test/system: speed up \"podman auto-update using systemd\"\n  * test/system: remove podman wait test\n  * tests: disable tests affected by a race condition\n  * update golangci-lint to v1.59.0\n  * kubernetes_support.md: Mark volumeMounts.subPath as supported\n  * working name of pod on start and stop\n  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.19.0\n  * Bump Buildah to v1.36.0\n  * fix(deps): update module github.com/burntsushi/toml to v1.4.0\n  * fix typo in Tutorials.rst\n  * Mac PM test: Require pre-installed rosetta\n  * test/e2e: fix new error message\n  * Add configuration for podmansh\n  * Update containers/common to latest main\n  * Only stop chowning volumes once they're not empty\n  * podman: fix --sdnotify=healthy with --rm\n  * libpod: wait another interval for healthcheck\n  * quadlet: Add a network requirement on .image units\n  * test, pasta: Ignore deprecated addresses in tests\n  * [CI:DOCS] performance: update network docs\n  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.18.0\n  * CI: disable minikube task\n  * [CI:DOCS] Fix windows action trigger\n  * chore(deps): update dependency setuptools to v70\n  * Check AppleHypervisor before accessing it\n  * fix(deps): update module github.com/containernetworking/plugins to v1.5.0\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.58.2\n  * add podman-clean-transient.service service to rootless\n  * [CI:DOCS] Update podman network docs\n  * fix incorrect host.containers.internal entry for rootless bridge mode\n  * vendor latest c/common main\n  * Add Rosetta support for Apple Silicon mac\n  * bump main to 5.2.0-dev\n  * Use a defined constant instead of a hard-coded magic value\n  * cirrus: use faster VM's for integration tests\n  * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 01a1a0c\n  * [CI:DOCS] Fix Mac pkg link\n  * test: remove test_podman* scripts\n  * test/system: fix documentation\n  * Return StatusNotFound when multiple volumes matching occurs\n  * container_api: do not wait for healtchecks if stopped\n  * libpod: wait for healthy on main thread\n  * `podman events`: check for an error after we finish reading events\n  * remote API: restore v4 payload in container inspect\n  * Fix updating connection when SSH port conflict happens\n  * rootless: fix reexec to use /proc/self/exe\n  * ExitWithError() - enforce required exit status \u0026 stderr\n  * ExitWithError() - a few that I missed\n  * [skip-ci] Packit: use only one value for `packages` key for `trigger: commit` copr builds\n  * Revert \"Temporarily disable rootless debian e2e testing\"\n  * CI tests: enforce TMPDIR on tmpfs\n  * use new CI images with tmpfs /tmp\n  * run e2e test on tmpfs\n  * Update module github.com/crc-org/crc/v2 to v2.36.0\n  * [CI:DOCS] Use checkout@v4 in GH Actions\n  * ExitWithError() - rmi_test\n  * ExitWithError() - more r files\n  * ExitWithError() - s files\n  * ExitWithError() - more run_xxx tests\n  * Fix podman-remote support for `podman farm build`\n  * [CI:DOCS] Trigger windows installer action properly\n  * Revert \"container stop: kill conmon\"\n  * Ensure that containers do not get stuck in stopping\n  * [CI:DOCS] Improvements to make validatepr\n  * ExitWithError() - rest of the p files\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.58.1\n  * Graceful shutdown during podman kube down\n  * Remove duplicate  call\n  * test/system: fix broken \"podman volume globs\" test\n  * Quadlet/Container: Add GroupAdd option\n  * Don't panic if a runtime was configured without paths\n  * update c/{buildah,common,image,storage} to latest main\n  * update golangci-lint to 1.58\n  * machine: Add LibKrun provider detection\n  * ExitWithError() - continue tightening\n  * fix(deps): update module google.golang.org/protobuf to v1.34.1\n  * test: improve test for powercap presence\n  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.17.3\n  * fix(deps): update module go.etcd.io/bbolt to v1.3.10\n  * fix(deps): update module golang.org/x/tools to v0.21.0\n  * [skip-ci] RPM: `bats` required only on Fedora\n  * fix(deps): update module golang.org/x/exp to v0.0.0-20240506185415-9bf2ced13842\n  * gpdate and remove parameter settings in `.golangci.yml`\n  * ExitWithError() - play_kube_test.go\n  * Temporarily disable rootless debian e2e testing\n  * fix(deps): update module golang.org/x/crypto to v0.23.0\n  * CI Docs: Clarify passthrough_envars() comments\n  * Skip machine tests if they don't need to be run\n  * Update CI VMs to F40, F39, D13\n  * ExitWithError() - v files\n  * Update module golang.org/x/term to v0.20.0\n  * machine: Add provider detection API\n  * util: specify a not empty pause dir for root too\n  * Add missing option 'healthy' to output of `podman run --help`\n  * [CI:DOCS] Add info on the quay.io images to the README.md\n  * Add a random suffix to healthcheck unit names\n  * test/e2e: remove toolbox image\n  * Also substitute $HOME in runlabel with user's homedir\n  * Update module github.com/cyphar/filepath-securejoin to v0.2.5\n  * Change tmpDir for macOS\n  * ExitWithError() - pod_xxx tests\n  * ExitWithError() -- run_test.go\n  * Update module golang.org/x/exp to v0.0.0-20240416160154-fe59bbe5cc7f\n  * Update module github.com/shirou/gopsutil/v3 to v3.24.4\n  * Update module github.com/docker/docker to v26.1.1+incompatible\n  * GHA: Attempt fix exceeded a secondary rate limit\n  * vendor ginkgo 2.17.2 into test/tools\n  * Fix machine volumes with long path and paths with dashes\n  * Update module google.golang.org/protobuf to v1.34.0\n  * Update module github.com/crc-org/crc/v2 to v2.35.0\n  * Update module github.com/onsi/gomega to v1.33.1\n  * test/e2e: podman unshare image mount fix tmpdir leak\n  * test/e2e: do not leak /tmp/private_file\n  * test/e2e: \"persistentVolumeClaim with source\" do not leak file\n  * e2e tests: use /var/tmp, not $TMPDIR, as workdirs\n  * Update dependency pytest to v8.1.2\n  * Remove unncessary lines at the end of specfile summary\n  * Clean machine pull cache\n  * Add krun support to podman machine\n  * Use custom image for make validatepr\n  * test/e2e: force systemd cgroup manager\n  * e2e and bindings tests: fix $PATH setup\n  * Makefile: remove useless HACK variable in e2e test\n  * test/e2e: fix volumes and suid/dev/exec options\n  * test/e2e: volumes and suid/dev/exec options works remote\n  * test/e2e: fix limits test\n  * Update module github.com/rootless-containers/rootlesskit/v2 to v2.1.0\n  * Correct option name `ip` -\u003e `ip6`\n  * Add the ability to automount images as volumes via play\n  * Add support for image volume subpaths\n  * Bump Buildah to latest main\n  * Update Makefile to Go 1.22 for in-container\n  * ExitWithError() - yet more low-hanging fruit\n  * ExitWithError() - more low-hanging fruit\n  * ExitWithError() - low-hanging fruit\n  * chore: fix function names in comment\n  * Remove redundant Prerequisite before build section\n  * Remove PKG_CONFIG_PATH\n  * Add installation instructions for openSUSE\n  * Replace golang.org/x/exp/slices with slices from std\n  * Update to go 1.21\n  * fix(deps): update module github.com/docker/docker to v26.1.0+incompatible\n  * [CI:DOCS] Fix artifact action\n  * [skip-ci] Packit/rpm: remove el8 jobs and spec conditionals\n  * e2e tests: stop littering\n  * [CI:DOCS] format podman-pull example as code\n  * [CI:DOCS] Build \u0026 upload release artifacts with GitHub Actions\n  * libpod: getHealthCheckLog() remove unessesary check\n  * add containers.conf healthcheck_events support\n  * vendor latest c/common\n  * libpod: make healthcheck events more efficient\n  * libpod: wrap store setup error message\n  * [skip-ci] Packit: enable CentOS 10 Stream build jobs\n  * pkg/systemd: use fileutils.(Le|E)xists\n  * pkg/bindings: use fileutils.(Le|E)xists\n  * pkg/util: use fileutils.(Le|E)xists\n  * pkg/trust: use fileutils.(Le|E)xists\n  * pkg/specgen: use fileutils.(Le|E)xists\n  * pkg/rootless: use fileutils.(Le|E)xists\n  * pkg/machine: use fileutils.(Le|E)xists\n  * pkg/domain: use fileutils.(Le|E)xists\n  * pkg/api: use fileutils.(Le|E)xists\n  * libpod: use fileutils.(Le|E)xists\n  * cmd: use fileutils.(Le|E)xists\n  * vendor: update containers/{buildah,common,image,storage}\n  * fix(deps): update module github.com/docker/docker to v26.0.2+incompatible [security]\n  * fix podman-pod-restart.1.md typo\n  * [skip-ci] Packit: switch to EPEL instead of centos-stream+epel-next\n  * fix(deps): update module github.com/onsi/gomega to v1.33.0\n  * Add more annnotation information to podman kupe play man page\n  * test/compose: remove compose v1 code\n  * CI: remove compose v1 tests\n  * fix: close resource file\n  * [CI:DOCS] Fix windows installer action\n  * fix(deps): update module tags.cncf.io/container-device-interface to v0.7.2\n  * add `list` as an alias to list networks\n  * Add support for updating restart policy\n  * Add Compat API for Update\n  * Make `podman update` changes persistent\n  * Emergency fix (well, skip) for failing bud tests\n  * fix swagger doc for manifest create\n  * [CI:DOCS] options/network: fix markdown lists\n  * Makefile: do not hardcode `GOOS` in `podman-remote-static` target\n  * chore(deps): update module golang.org/x/crypto to v0.17.0 [security]\n  * chore(deps): update dependency setuptools to ~=69.5.0\n  * Fix some comments\n  * swagger fix infinitive recursion on some types\n  * install swagger from source\n  * Revert \"Swap out javascript engine\"\n  * podman exec CID without command should exit 125\n  * (minor) prefetch systemd image before use\n  * Update go-swagger version\n  * Swap out javascript engine\n  * fix(deps): update module github.com/docker/docker to v26.0.1+incompatible\n  * Add os, arch, and ismanifest to libpod image list\n  * [CI:DOCS]Initial PR validation\n  * fix(deps): update github.com/containers/gvisor-tap-vsock digest to d744d71\n  * vendor ginkgo 2.17.1 into test/tools\n  * fix \"concurrent map writes\" in network ls compat endpoint\n  * chore(deps): update dependency pytest to v8\n  * e2e: redefine ExitWithError() to require exit code\n  * docs: fix missleading run/create --expose description\n  * podman ps: show exposed ports under PORTS as well\n  * rootless: drop function ReadMappingsProc\n  * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.7.3\n  * New CI VMs, to give us pasta 2024-04-05\n  * Add big warning to GHA workflow\n  * GHA: Fix intermittent workflow error\n  * fix(deps): update module golang.org/x/tools to v0.20.0\n  * e2e tests: remove requirement for fuse-overlayfs\n  * docs: update Quadlet volume Options desc\n  * fix(deps): update module golang.org/x/sync to v0.7.0\n  * Fix relabeling failures with Z/z volumes on Mac\n  * fix(deps): update module golang.org/x/net to v0.24.0\n  * Makefile: fix annoying errors in docs generation\n  * chore: fix function names in comment\n  * Bump tags.cncf.io/container-device-interface to v0.7.1\n  * fix(deps): update module golang.org/x/crypto to v0.22.0\n  * Detect unhandled reboots and require user intervention\n  * podman --runroot: remove 50 char length restriction\n  * update github.com/rootless-containers/rootlesskit to v2\n  * Update module github.com/gorilla/schema to v1.3.0\n  * Update dependency requests-mock to ~=1.12.1\n  * Update module github.com/crc-org/crc/v2 to v2.34.1\n  * rm --force work for more than one arg\n  * [CI:DOCS] Update kube docs\n  * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.24.3\n  * [CI:DOCS] Add GitHub action to update version on Podman.io\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.57.2\n  * Windows: clean up temporary perl install\n  * pkg/util: FindDeviceNodes() ignore ENOENT errors\n  * [CI:DOCS] build deps: make-validate needs docs\n  * test/system: add rootless-netns test for setup errors\n  * vendor latest c/common main\n  * container: do not chown to dest target with U\n  * [CI:DOCS] golangci-lint: update deprecated flags\n  * systests: conditionalize slirp4netns tests\n  * CI: systests: instrument flaky tests\n  * s3fs docs\n  * test: do not skip tests under rootless\n  * Add note about host networking to Kube PublishPort option\n  * Inject additional build tags from the environment\n  * libpod: use original IDs if idmap is provided\n  * Switch back to checking out the same branch the action script runs in\n  * docs/podman-login: Give an example of writing the persistent path\n  * CI: Bump VMs to 2024-03-28\n  * [skip-ci] Update dawidd6/action-send-mail action to v3.12.0\n  * fix(deps): update module github.com/openshift/imagebuilder to v1.2.7\n  * Fix reference to deprecated types.Info\n  * Use logformatter for podman_machine_windows_task\n  * applehv: Print vfkit logs in --log-level debug\n  * [CI:DOCS]Add Mario to reviewers list\n  * [CI:DOCS] Document CI-maintenance job addition\n  * Add golang 1.21 update warning\n  * Add rootless network command to `podman info`\n  * libpod: don't warn about cgroupsv1 on FreeBSD\n  * hyperv: error if not admin\n  * Properly parse stderr when updating container status\n  * [skip-ci] Packit: specify fedora-latest in propose-downstream\n  * Use built-in ssh impl for all non-pty operations\n  * Add support for annotations\n  * hyperv: fix machine rm -r\n  * [skip-ci] Packit: Enable CentOS Stream 10 update job\n  * 5.0 release note fix typo in cgroupv1 env var\n  * fix remote build isolation on client side\n  * chore: remove repetitive words\n  * Dont save remote context in temp file but stream and extract\n  * fix remote build isolation when server runs as root\n  * util: use private propagation with bind\n  * util: add some tests for ProcessOptions\n  * util: refactor ProcessOptions into an internal function\n  * util: rename files to snake case\n  * Add LoongArch support for libpod\n  * fix(deps): update github.com/containers/common digest to bc5f97c\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.57.1\n  * fix(deps): update module github.com/docker/docker to v25.0.5+incompatible [security]\n  * fix(deps): update module github.com/onsi/gomega to v1.32.0\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.57.0\n  * Update module github.com/cpuguy83/go-md2man/v2 to v2.0.4\n  * Fix type-o\n  * Use correct extension in suite\n  * minikube: instrument tests, to allow debugging failures\n  * libpod: restart always reconfigure the netns\n  * use new c/common pasta2 setup logic to fix dns\n  * utils: drop conversion float-\u003estring-\u003efloat\n  * utils: do not generate duplicate range\n  * logformatter: handle Windows logs\n  * utils: add test for the new function\n  * utils: move rootless code to a new function\n  * xref-helpmsgs-manpages: cross-check Commands.rst\n  * test/system: Add support for multipath routes in pasta networking tests\n  * [skip-ci] rpm: use macro supported vendoring\n  * Adjust to the standard location of gvforwarder used in new images\n  * Makefile: add target `podman-remote-static`\n  * Switch to 5.x WSL machine os stream using new automation\n  * Cleanup build scratch dir if remote end disconnects while passing the context\n  * bump main to 5.1.0-dev\n  * Use faster gzip for compression for 3x speedup for sending large contexts to remote\n  * pkg/machine: make checkExclusiveActiveVM race free\n  * pkg/machine/wsl: remove unused CheckExclusiveActiveVM()\n  * pkg/machine: CheckExclusiveActiveVM should also check for starting\n  * pkg/machine: refresh config after we hold lock\n  * Update dependency setuptools to ~=69.2.0\n  * [skip-ci] rpm: update containers-common dep on f40+\n  * fix invalid HTTP header values when hijacking a connection\n  * Add doc to build podman on windows without MSYS\n  * Removing CRI-O related annotations\n  * fix(deps): update module github.com/containers/ocicrypt to v1.1.10\n  * Pass the restart policy to the individual containers\n  * kube play: always pull when both imagePullPolicy and tag are missing\n\n","status":"published","published":"2025-04-22T13:50:31Z","modified":"2026-03-23T04:47:11.871842Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}