ALSA-2022:8431

Dashboard / Vulnerabilities / ALSA-2022:8431

ALSA-2022:8431

Summary: Low: podman security, bug fix, and enhancement update

Details: The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * podman: possible information disclosure and modification (CVE-2022-2989) * buildah: possible information disclosure and modification (CVE-2022-2990) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * (podman image trust) does not support the new trust type "sigstoreSigned " (BZ#2120436) * dnf-update broken for podman/catatonit (BZ#2123319) * podman creates lock file in /etc/cni/net.d/cni.lock instead of /run/lock/ (BZ#2123905) * podman kill may deadlock [AlmaLinux 9.1] (BZ#2124716) * containers config.json gets empty after sudden power loss (BZ#2136278) * PANIC podman API service endpoint handler panic (BZ#2136287) Enhancement(s): * Podman volume plugin timeout should be configurable [almalinux-9.1.0 Z] (BZ#2124676) * [RFE]Podman support to perform custom actions on unhealthy containers (BZ#2136281)

References: https://access.redhat.com/errata/RHSA-2022:8431, https://access.redhat.com/security/cve/CVE-2022-2989, https://access.redhat.com/security/cve/CVE-2022-2990, https://bugzilla.redhat.com/2121445, https://bugzilla.redhat.com/2121453, https://errata.almalinux.org/9/ALSA-2022-8431.html