Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

rocky логотип

RLSA-2026:69961

Опубликовано: 23 сент. 2026
Источник: rocky
Оценка: Important

Описание

Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

  • podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

  • podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

  • podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

  • podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

  • podman: Quadlet install --replace non-truncating write retains removed host-access directives (CVE-2026-19730)

  • podman: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)

  • podman: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

  • podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Затронутые продукты

  • Rocky Linux 9

НаименованиеАрхитектураРелизRPM
podmanaarch647.el9_8podman-5.8.2-7.el9_8.aarch64.rpm
podman-dockernoarch7.el9_8podman-docker-5.8.2-7.el9_8.noarch.rpm
podman-pluginsaarch647.el9_8podman-plugins-5.8.2-7.el9_8.aarch64.rpm
podman-remoteaarch647.el9_8podman-remote-5.8.2-7.el9_8.aarch64.rpm
podman-testsaarch647.el9_8podman-tests-5.8.2-7.el9_8.aarch64.rpm
podmanx86_647.el9_8podman-5.8.2-7.el9_8.x86_64.rpm
podman-pluginsx86_647.el9_8podman-plugins-5.8.2-7.el9_8.x86_64.rpm
podman-remotex86_647.el9_8podman-remote-5.8.2-7.el9_8.x86_64.rpm
podman-testsx86_647.el9_8podman-tests-5.8.2-7.el9_8.x86_64.rpm

Показывать по

Связанные CVE

CVE-2026-17106
CVE-2026-19730
CVE-2026-33818
CVE-2026-39830
CVE-2026-56853
CVE-2026-56858
CVE-2026-56859
CVE-2026-56860
CVE-2026-56862

Ссылки на источники

Исправления

Связанные уязвимости

oracle-oval логотип

ELSA-2026-69961

oracle-oval
9 дней назад

ELSA-2026-69961: podman security update (IMPORTANT)

rocky логотип

RLSA-2026:70201

rocky
8 дней назад

Important: podman security update

oracle-oval логотип

ELSA-2026-70201

oracle-oval
9 дней назад

ELSA-2026-70201: podman security update (IMPORTANT)

ubuntu логотип

CVE-2026-17106

ubuntu
около 1 месяца назад

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

redhat логотип

CVE-2026-17106

CVSS3: 7.8
redhat
около 1 месяца назад

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.