Information disclosure in podman (Red Hat package) - CVE-2022-2739

Vulnerability identifier: #VU66697

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-2739

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a missing patch for #VU47117 (CVE-2020-14370) in podman Red Hat package. A remote user with control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.

podman (Red Hat package)
podman
podman-remote
podman-tests
podman-docker
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Anolis OS

Install updates from vendor's website.

podman (Red Hat package) - update to 1.6.4-36.el7_9
podman - update to 1.6.4-36
podman-remote - update to 1.6.4-36
podman-tests - update to 1.6.4-36
podman-docker - update to 1.6.4-36

• https://bugzilla.redhat.com/show_bug.cgi?id=2116927

• Red Hat Enterprise Linux 7 Extras update for podman
• Anolis OS update for podman