REDHAT-BUG-2493620: High severity Podman Podman vulnerability
Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk () will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.8.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2493620?
The severity of REDHAT-BUG-2493620 is rated high with a score of 7.
What are the potential risks associated with REDHAT-BUG-2493620?
The risk associated with REDHAT-BUG-2493620 is that an environment variable with a key but no value may be passed from the host to the container, potentially leading to unauthorized access or exposure.
How do I fix REDHAT-BUG-2493620?
To fix REDHAT-BUG-2493620, update Podman to a version above 5.8.4 to mitigate the vulnerability.
Which versions of Podman are affected by REDHAT-BUG-2493620?
Podman versions from 1.8.1 up to 5.8.4 are affected by REDHAT-BUG-2493620.
What impact does REDHAT-BUG-2493620 have on container security?
REDHAT-BUG-2493620 can compromise container security by enabling unintended environment variable exposure from the host to the container.