Podman Project
Podman Project Podman: vulnerabilidades y CVE
Podman Project Podman tiene 17 vulnerabilidades publicadas, 3 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE17
Últimos 12 meses3
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-57231 | Alta (7.5) | 0.44% | — | 26 jun 2026 | Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the… |
| CVE-2026-55686 | Media (5.3) | 0.40% | — | 26 jun 2026 | Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host… |
| CVE-2026-33414 | Media (4) | 0.68% | — | 14 abr 2026 | Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image path is… |
| CVE-2024-3056 | Media (4.8) | 0.55% | — | 2 ago 2024 | A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least one other container, can create a large number of IPC… |
| CVE-2023-0778 | Media (6.8) | 0.54% | — | 27 mar 2023 | A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files… |
| CVE-2022-4123 | Baja (3.3) | 0.24% | — | 8 dic 2022 | A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality. |
| CVE-2022-4122 | Media (5.3) | 0.83% | — | 8 dic 2022 | A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure. |
| CVE-2022-2989 | Alta (7.1) | 0.32% | — | 13 sept 2022 | An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected… |
| CVE-2022-2739 | Media (5.3) | 0.51% | — | 1 sept 2022 | The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-14370, which was previously fixed via… |
| CVE-2022-2738 | Alta (7.5) | 0.91% | — | 1 sept 2022 | The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-8945, which was previously fixed via… |
| CVE-2019-25067 | Alta (8.8) | 2.6% | — | 9 jun 2022 | A vulnerability, which was classified as critical, was found in Podman and Varlink 1.5.1. This affects an unknown part of the component API. The manipulation leads to Remote Privilege Escalation. It is possible to… |
| CVE-2022-1227 | Alta (8.8) | 4.2% | — | 29 abr 2022 | A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after… |
| CVE-2022-27649 | Alta (7.5) | 1.4% | — | 4 abr 2022 | A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty… |
| CVE-2021-4024 | Media (6.5) | 1.1% | — | 23 dic 2021 | A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on… |
| CVE-2021-20188 | Alta (7) | 0.26% | — | 11 feb 2021 | A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access… |
| CVE-2021-20199 | Media (5.9) | 1.1% | — | 2 feb 2021 | Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by… |
| CVE-2020-14370 | Media (5.3) | 1.4% | — | 23 sept 2020 | An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short… |