Moderate: podman security update
Summary
ALSA-2024:2193: Moderate: podman security update. Affects podman versions < 2:4.9.4-0.1.el9. Fixed in 2:4.9.4-0.1.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Podman is a tool that manages pods, container images, and containers. It is part of the libpod library, which is used by applications that utilize container pods. Container pods are a concept in Kubernetes. The tool allows users to create, run, and manage containers and pods. It provides a command-line interface for interacting with containers and offers features such as container networking, storage management, and image management.
Vulnerability Detail
The vulnerability identified in this security update includes two separate issues:
-
Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326): This vulnerability exists in the net/http/internal package of the Go programming language. An attacker can exploit this vulnerability by sending specially crafted HTTP requests, leading to excessive resource consumption and potentially causing a denial of service.
-
Timing Side Channel attack in RSA based TLS key exchanges (CVE-2023-45287): This vulnerability affects the crypto/tls package of the Go programming language. It allows an attacker to perform a timing side-channel attack during RSA-based TLS key exchanges, potentially exposing sensitive information.
These vulnerabilities can be exploited by remote attackers to disrupt the availability of the affected system or potentially gain access to sensitive information.
How To Fix
Minimum fixed version
2:4.9.4-0.1.el9
This is the first release that contains the fix.
sudo dnf update podmanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the podman tool has been found to have two security vulnerabilities, namely CVE-2023-39326 and CVE-2023-45287. These vulnerabilities can be fixed by updating the podman package to version 2:4.9.4-0.1.el9 or later. It is important to promptly apply the security update to ensure the integrity and security of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for podman →
FAQ
Podman is a tool used for managing pods, container images, and containers. It is commonly used in Kubernetes environments.
CVE-2023-39326 can be exploited by remote attackers to consume excessive resources, potentially leading to a denial of service.
CVE-2023-45287 allows an attacker to perform a timing side-channel attack during RSA-based TLS key exchanges, potentially exposing sensitive information.
You can update the podman package by using your package manager or manually downloading and installing the updated version from the official AlmaLinux repositories.
No specific workaround has been provided for these vulnerabilities. It is recommended to update the podman package to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for podman.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
