GHSA-66vw-v2x9-hw75HighCVSS 8.8

Podman publishes a malicious image to public registries

Published
April 30, 2022
Last Modified
September 16, 2024

🔗 CVE IDs covered (1)

📋 Description

Podman is a tool for managing OCI containers and pods. A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.

🎯 Affected products2

  • go/github.com/containers/psgo:< 1.7.2
  • go/github.com/containers/podman/v3:< 3.4

🔗 References (11)