Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:03584-1

Опубликовано: 13 окт. 2025
Источник: suse-cvrf

Описание

Security update for podman

This update for podman fixes the following issues:

  • CVE-2025-9566: fixed an issue in kube play command that could cause overwriting host files (bsc#1249154)

Список пакетов

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
podman-4.9.5-150400.4.53.1
podman-docker-4.9.5-150400.4.53.1
podman-remote-4.9.5-150400.4.53.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
podman-4.9.5-150400.4.53.1
podman-docker-4.9.5-150400.4.53.1
podman-remote-4.9.5-150400.4.53.1
SUSE Linux Enterprise Micro 5.3
podman-4.9.5-150400.4.53.1
podman-remote-4.9.5-150400.4.53.1
SUSE Linux Enterprise Micro 5.4
podman-4.9.5-150400.4.53.1
podman-remote-4.9.5-150400.4.53.1
SUSE Linux Enterprise Server 15 SP4-LTSS
podman-4.9.5-150400.4.53.1
podman-docker-4.9.5-150400.4.53.1
podman-remote-4.9.5-150400.4.53.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4
podman-4.9.5-150400.4.53.1
podman-docker-4.9.5-150400.4.53.1
podman-remote-4.9.5-150400.4.53.1

Ссылки

Описание

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.53.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.53.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.53.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.53.1
Ссылки