Podman publishes a malicious image to public registries

CAO 8.8CVE-2022-1227 · GHSA-66vw-v2x9-hw75 · GO-2022-0558 · Công bố 29/04/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-1227 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng github.com/containers/podman/v3, github.com/containers/psgo, podman (podman project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 4.2%, cao hơn 90.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.4, 1.7.2, 4.0.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/containers/podman/v3 Go	`< 3.4`	`3.4`
github.com/containers/psgo Go	`< 1.7.2`	`1.7.2`
podman podman_project	`< 4.0.0`	`4.0.0`
psgo psgo_project	`< 1.7.2`	`1.7.2`
developer tools redhat	`= 1.0`	Chưa có bản vá
enterprise linux server update services for sap solutions redhat	`= 8.6`	Chưa có bản vá
openshift container platform redhat	`= 4.0`	Chưa có bản vá
quay redhat	`= 3.0.0`	Chưa có bản vá

Mô tả

Podman is a tool for managing OCI containers and pods. A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.

Mô tả của NVD

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.