podman vulnerabilities (Alpaquita)
50 vulnerabilities.
podmanAlpaquitaPodman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers3.3 LowpodmanAlpaquitaGvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose9.3 CriticalpodmanAlpaquitaHTTP/2 server crash due to HPACK encoder race in net/http7.5 HighpodmanAlpaquitaExcessive CPU consumption from repeated initial window changes in net/http7.5 HighpodmanAlpaquitaDouble flow control refund on HTTP/2 server streams in net/http9.1 CriticalpodmanAlpaquitaPodman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation10.0 CriticalpodmanAlpaquitaPodman: arbitrary file write when importing oci archive5.5 MediumpodmanAlpaquitaPodman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory4.4 MediumpodmanAlpaquitaPodman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers4.5 MediumpodmanAlpaquitaSource-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh7.5 HighpodmanAlpaquitaTar extraction in moby/go-archive can write outside the destination directory via link following7.1 HighpodmanAlpaquitaPodman: podman: quadlet install --replace non-truncating write retains removed host-access directives4.2 MediumpodmanAlpaquitaParsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage7.5 HighpodmanAlpaquitaPodman: Malformed Image can trick podman run into leaking host environment variables into the container7.5 HighpodmanAlpaquitaPodman: WORKDIR symlink traversal vulnerability5.3 MediumpodmanAlpaquitaBuildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive6.3 MediumpodmanAlpaquitaInvoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html6.1 MediumpodmanAlpaquitaInvoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html6.1 MediumpodmanAlpaquitaInvoking duplicate attributes can cause XSS in golang.org/x/net/html6.1 MediumpodmanAlpaquitaInvoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html6.1 MediumpodmanAlpaquitaInvoking denial of service when parsing arbitrary HTML in golang.org/x/net/html6.5 MediumpodmanAlpaquitaInvoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent5.3 MediumpodmanAlpaquitaInvoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh7.5 HighpodmanAlpaquitaInvoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh10.0 CriticalpodmanAlpaquitaInvoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts9.1 CriticalpodmanAlpaquitaInvoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh5.3 MediumpodmanAlpaquitaInvoking infinite loop on large channel writes in golang.org/x/crypto/ssh9.1 CriticalpodmanAlpaquitaInvoking key constraints not enforced in golang.org/x/crypto/ssh/agent9.1 CriticalpodmanAlpaquitaInvoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent9.1 CriticalpodmanAlpaquitaInvoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh9.1 CriticalpodmanAlpaquitaInvoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh9.1 CriticalpodmanAlpaquitaInvoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh7.5 HighpodmanAlpaquitaInvoking bypass of certificate restrictions in golang.org/x/crypto/ssh6.3 MediumpodmanAlpaquitaInvoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh6.5 MediumpodmanAlpaquitarunc: LSM labels can be bypassed with malicious config using dummy procfs files7.3 HighpodmanAlpaquitaPodman: podman kube play command may overwrite host files8.1 HighpodmanAlpaquitaPodman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile8.6 HighpodmanAlpaquitaPodman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)6.5 MediumpodmanAlpaquitaBuildah: buildah allows arbitrary directory mount7.8 HighpodmanAlpaquitaBuildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction4.7 MediumpodmanAlpaquitaPodman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library5.4 MediumpodmanAlpaquitaContainers/image: digest type does not guarantee valid type8.3 HighpodmanAlpaquitaBuildah: buildah: container escape via improper bind mount validation8.6 HighpodmanAlpaquitaBuildKit interactive containers API does not validate entitlements check9.8 CriticalpodmanAlpaquitaBuildKit possible host system access from mount stub cleaner10.0 CriticalpodmanAlpaquitaBuildKit possible race condition with accessing subpaths from cache mounts8.7 HighpodmanAlpaquitaPrefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin5.9 MediumpodmanAlpaquitaPodman Time-of-check Time-of-use (TOCTOU) Race Condition6.8 MediumpodmanAlpaquitaDenial of service via crafted HTTP/2 stream in net/http and golang.org/x/net7.5 HighpodmanAlpaquitaInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna9.6 Critical