SUSE-SU-2025:20279-1

SUSE-SU-2025:20279-1 · Security update for podman

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.

This update for podman fixes the following issues: - CVE-2023-45288: Fixed closing connection when receiving too many headers (bsc#1236507). - CVE-2024-11218: Fixed container breakout by using --jobs=2 and a race condition when building a malicious Containerfile (bsc#1236270). - CVE-2025-22869: Fixed Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239330). - CVE-2025-27144: Fixed Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237641). - CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (bsc#1231208). - CVE-2024-3727: Fixed digest type (bsc#1224112). - CVE-2024-1753: Fixed full container escape at build time (bsc#1221677). Other fixes: - Updated to version 5.2.5: * RPM: remove dup Provides * Packit: constrain koji and bodhi jobs to fedora package to avoid dupes * Validate the bind-propagation option to `--mount` * Updated Buildah to v1.37.4 * vendor: updated c/common to v0.60.4 * pkg/specgen: allow pasta when running inside userns * libpod: convert owner IDs only with :idmap * allow exposed sctp ports * libpod: setupNetNS() correctly mount netns * vendor: updated c/common to v0.60.3 * [skip-ci] Packit: split out ELN jobs and reuse fedora downstream targets * [skip-ci] Packit: Enable sidetags for bodhi updates * Updated gvisor-tap-vsock to 0.7.5 * CI: podman-machine: do not use cache registry * [CI:DOCS] Add v5.2.2 lib updates to RELEASE_NOTES.md * Update RELEASE_NOTES for v5.2.2 * [v5.2] Bump Buildah to v1.37.2, c/common v0.60.2, c/image v5.32.2 * [v5.2] golangci-lint: make darwin linting happy * [v5.2] golangci-lint: make windows linting happy * [v5.2] test/e2e: remove kernel version check * [v5.2] golangci-lint: remove most skip dirs * [v5.2] set !remote build tags where needed * [v5.2] update golangci-lint to 1.60.1 * Packit: update targets for propose-downstream * Create volume path before state initialization * Update Cirrus DEST_BRANCH * Bump to v5.2.2-dev * Bump to v5.2.1 * Update release notes for v5.2.1 * [v5.2] Add zstd:chunked test fix * [v5.2] Bump Buildah to v1.37.1, c/common v0.60.1, c/image v5.32.1 * libpod: reset state error on init * libpod: do not save expected stop errors in ctr state * libpod: fix broken saveContainerError() * Bump to v5.2.1-dev * Bump to v5.2.0 * Never skip checkout step in release workflow * Bump to v5.2.0-dev * Bump to v5.2.0-rc3 * Update release notes for v5.2.0-rc3 * Tweak versions in register_images.go * fix network cleanup flake in play kube * WIP: Fixes for vendoring Buildah * Add --compat-volumes option to build and farm build * Bump Buildah, c/storage, c/image, c/common * libpod: bind ports before network setup * pkg/api: do not leak config pointers into specgen * build: Update gvisor-tap-vsock to 0.7.4 * test/system: fix borken pasta interface name checks * test/system: fix bridge host.containers.internal test * CI: system tests: instrument to allow failure analysis * Use uploaded .zip for Windows action * RPM: podman-iptables.conf only on Fedora * Bump to v5.2.0-dev * Bump to v5.2.0-rc2 * Update release notes for v5.2.0-rc2 * test/e2e: fix ncat tests * libpod: add hidden env to set sqlite timeout * Add support for StopSignal in quadlet .container files * podman pod stats: fix race when ctr process exits * Update module github.com/vbauerster/mpb/v8 to v8.7.4 * libpod: correctly capture healthcheck output * Bump bundled krunkit to 0.1.2 * podman stats: fix race when ctr process exists * nc -p considered harmful * podman pod stats: fix pod rm race * podman ps: fix racy pod name query * system connection remove: use Args function to validate * pkg/machine/compression: skip decompress bar for empty file * nc -p considered harmful * podman system df: fix fix ErrNoSuchCtr/Volume race * podman auto-update: fix ErrNoSuchCtr race * Fix name for builder in farm connection * 700-play.bats: use unique pod/container/image/volume names * safename: consistent within same test, and, dashes * 700-kube.bats: refactor $PODMAN_TMPDIR/test.yaml * 700-play.bats: eliminate $testYaml * 700-play.bats: refactor clumsy yamlfile creation * 700-play.bats: move _write_test_yaml up near top * chore(deps): update dependency setuptools to v71 * Expand drop-in search paths * top-level (pod.d) * truncated (unit-.container.d) * Remove references and checks for --gpus * Do not crash on invalid filters * fix(deps): update module github.com/rootless-containers/rootlesskit/v2 to v2.2.0 * Bump to v5.2.0-dev * Bump to v5.2.0-rc1 * Keep the volume-driver flag deprecated * Vendor in latest containers(common, storage,image, buildah) * System tests: safe container/image/volume/etc names * Implement disable default mounts via command line * test: drop unmount for overlay * test: gracefully terminate server * libpod: shutdown Stop waits for handlers completion * libpod: cleanup store at shutdown * Add NetworkAlias= support to quadlet * cmd: call shutdown handler stop function * fix race conditions in start/attach logic * swagger: exlude new docker network types * vendor: bump c/storage * update to docker 27 * contrib: use a distinct --pull-option= for each flag * Update warning message when using external compose provider * Update module github.com/cyphar/filepath-securejoin to v0.3.0 * Ignore result of EvalSymlinks on ENOENT * test/upgrade: fix tests when netavark uses nftables * test/system: fix network reload test with nftables * test/e2e: rework some --expose tests * test: remove publish tests from e2e * CI: test nftables driver on fedora * CI: use local registry, part 3 of 3: for developers * CI: use local registry, part 2 of 3: fix tests * CI: use local registry, part 1 of 3: setup * CI: test composefs on rawhide * chore(deps): update module google.golang.org/grpc to v1.64.1 [security] * chore(deps): update dependency setuptools to ~=70.3.0 * Improve container filenname ambiguity. * containers/attach: Note bug around goroutine leak * Drop minikube CI test * add libkrun test docs * fix(deps): update module tags.cncf.io/container-device-interface to v0.8.0 * cirrus: check for header files in source code check * pkg/machine/e2e: run debug command only for macos * create runtime's worker queue before queuing any job * test/system: fix pasta host.containers.internal test * Visual Studio BuildTools as a MinGW alternative * SetupRootless(): only reexec when needed * pkg/rootless: simplify reexec for container code * cirrus: add missing test/tools to danger files * fix(deps): update module golang.org/x/tools to v0.23.0 * Windows Installer: switch to wix5 * fix(deps): update module golang.org/x/net to v0.27.0 * pkg/machine/e2e: print tests timings at the end * pkg/machine/e2e: run debug commands after init * pkg/machine/e2e: improve timeout handling * libpod: first delete container then cidfile * fix(deps): update module golang.org/x/term to v0.22.0 * System test fixes * cirrus.yml: automatic skips based on source * fix(deps): update module github.com/containers/ocicrypt to v1.2.0 * podman events: fix error race * chore(deps): update dependency setuptools to ~=70.2.0 * fix(deps): update module github.com/gorilla/schema to v1.4.1 [security] * Update CI VM images * pkg/machine/e2e: fix broken cleanup * pkg/machine/e2e: use tmp file for connections * test/system: fix podman --image-volume to allow tmpfs storage * CI: mount tmpfs for container storage * docs: --network remove missing leading sentence * specgen: parse devices even with privileged set * vendor: update c/storage * Remove the unused machine volume-driver * feat(quadlet): log option handling * Error when machine memory exceeds system memory * machine: Always use --log-file with gvproxy * CI: Bu

Correctif disponible

Publication

2025-04-22T13:50:31Z

Mise à jour

2026-03-23T04:47:11.871842Z

Pile logicielle: system

Vérifiez votre serveur →