Critical Security Update for Podman: Addressing Race Condition and File Overwrite Vulnerabilities
Summary
ALSA-2025:20909: Important: podman security update. Affects podman versions < 6:5.6.0-6.el9_7. Fixed in 6:5.6.0-6.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Podman is a powerful tool designed for managing pods, container images, and containers, integral to the libpod library. It enables users to run and manage containers without requiring a daemon, making it lightweight and efficient. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing Podman, particularly in environments where container orchestration is employed, such as Kubernetes.
Vulnerability Detail
The vulnerabilities stem from two main issues: a race condition in the Postgres scan functionality (CVE-2025-47907) and a potential for the Podman kube play command to overwrite host files (CVE-2025-9566). The race condition could allow unauthorized access to sensitive data, while the file overwrite issue poses a risk of data loss or corruption, potentially leading to system instability or breaches.
How To Fix
Minimum fixed version
6:5.6.0-6.el9_7
This is the first release that contains the fix.
sudo dnf update podmanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the Podman kube play command until the update is applied. Additionally, ensure that sensitive files are backed up and monitor for any unusual activity in your container environments.
Conclusion
In summary, the identified vulnerabilities in Podman pose significant risks to users and their systems. It is crucial to update to the latest patched version to mitigate these risks effectively. Users are encouraged to monitor their systems and utilize tools like Vulert for ongoing vulnerability management.
See every vulnerability recorded for podman →
FAQ
Podman is a container management tool that allows users to create, manage, and run containers and pods without a central daemon.
The vulnerabilities include a race condition in the Postgres scan functionality and a risk of file overwriting with the Podman kube play command.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check for vulnerabilities without needing to sign up.
If an immediate update is not possible, refrain from using the Podman kube play command and ensure that all sensitive data is backed up.
Detailed information can be found on the CVE pages for CVE-2025-47907 and CVE-2025-9566, which provide insights into the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for podman.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
