Podman publishes a malicious image to public registries

高 8.8CVE-2022-1227 · GHSA-66vw-v2x9-hw75 · GO-2022-0558 · 29/04/2022 公開 · 17/06/2026 更新

要点

CVE-2022-1227 は github.com/containers/podman/v3, github.com/containers/psgo, podman (podman project) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：4.2%（全脆弱性の 90.9% より高い）。
対処：3.4, 1.7.2, 4.0.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/containers/podman/v3 Go	`< 3.4`	`3.4`
github.com/containers/psgo Go	`< 1.7.2`	`1.7.2`
podman podman_project	`< 4.0.0`	`4.0.0`
psgo psgo_project	`< 1.7.2`	`1.7.2`
developer tools redhat	`= 1.0`	修正版なし
enterprise linux server update services for sap solutions redhat	`= 8.6`	修正版なし
openshift container platform redhat	`= 4.0`	修正版なし
quay redhat	`= 3.0.0`	修正版なし

概要

Podman is a tool for managing OCI containers and pods. A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.

NVD の説明

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.