CVE-2022-1227: Privilege Escalation in Podman Allows Publishing of Malicious Images
Summary
CVE-2022-1227: Podman publishes a malicious image to public registries. Affects github.com/containers/podman/v3 versions < 3.4. Fixed in 3.4. How to fix ↓
Also tracked for
- github.com/containers/psgo · Go
- golang-github-containers-psgo · Debian:11
The same CVE-2022-1227 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is a powerful tool used for managing OCI containers and pods. It provides a user-friendly interface for creating, running, and managing containers. Podman is widely used in the Go ecosystem and is known for its robustness and security. However, a privilege escalation vulnerability has been discovered in Podman, which allows an attacker to publish a malicious image to a public registry. This vulnerability affects versions 0 to 4.0.0 of the 'github.com/containers/podman' package, as well as versions 0 to 1.7.2 of the 'github.com/containers/psgo' and 'github.com/containers/psgo/internal/proc' packages.
Vulnerability Detail
The privilege escalation vulnerability in Podman allows an attacker to publish a malicious image to a public registry. When a potential victim downloads this image and runs the 'podman top' command, the vulnerability is triggered. This action grants the attacker access to the host filesystem, potentially leading to information disclosure or denial of service. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: v3.4.7 as of 22 Oct 2026
go get github.com/containers/podman/v3@v3.4.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4
This is the first release that contains the fix.
go get github.com/containers/podman/v3@v3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the affected packages to the fixed versions as soon as possible.
Conclusion
The privilege escalation vulnerability in Podman allows an attacker to publish a malicious image to a public registry, potentially leading to information disclosure or denial of service. It is crucial to update the affected packages to the fixed versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containers/podman/v3 →
FAQ
Podman is a tool for managing OCI containers and pods. It provides a user-friendly interface for creating, running, and managing containers.
The vulnerability allows an attacker to publish a malicious image to a public registry. When a user runs the 'podman top' command on a system with the downloaded image, the attacker gains access to the host filesystem, potentially leading to information disclosure or denial of service.
The vulnerability affects versions 0 to 4.0.0 of the 'github.com/containers/podman' package, as well as versions 0 to 1.7.2 of the 'github.com/containers/psgo' and 'github.com/containers/psgo/internal/proc' packages.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
To fix this vulnerability, update the affected packages to their respective fixed versions. For 'github.com/containers/podman', upgrade to version 4.0.0 or later. For 'github.com/containers/psgo' and 'github.com/containers/psgo/internal/proc', upgrade to version 1.7.2 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/podman/v3.
