SUSE-SU-2025:20805-1

SUSE-SU-2025:20805-1 · Security update for podman

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.

This update for podman fixes the following issues: - CVE-2025-6032: Fixed machine init command failing to verify TLS certificate (bsc#1245320) - Fix conditional Requires (remove deprecated sle_version macro) - Update to version 5.4.2: * Add release notes for v5.4.2 * Fix a potential deadlock during `podman cp` * Improve the file format documentation of podman-import. * Revert "podman-import only supports gz and tar" * Bump buildah to v1.39.4 * libpod: do not cover idmapped mountpoint * test: Fix runc error message * oci: report empty exec path as ENOENT * test: adapt tests new crun error messages * test: remove duplicate test * cirrus: test only on f41/rawhide * CI: use z1d instance for windows machine testing * New images 2025-03-24 * test/e2e: use go net.Dial() ov nc * test: use ncat over nc * New images 2025-03-12 * RPM: Add riscv64 to ExclusiveArch-es * Fix HealthCheck log destination, count, and size defaults * Win installer test: hardcode latest GH release ID * Packit: Fix action script for fetching upstream commit * Bump to v5.4.2-dev * Bump to v5.4.1 * update gvproxy version to 0.8.4 * Update Buildah to v1.39.2 * Update release notes for v5.4.1 * Fix reporting summed image size for compat endpoint * podman-import only supports gz and tar * quadlet kube: correctly mark unit as failed * pkg/domain/infra/abi/play.go: fix two nilness issues * kube play: don't print start errors twice * libpod: race in WaitForConditionWithInterval() * libpod: race in WaitForExit() with autoremove * Don't try to resolve host path if copying to container from stdin. * Use svg for pkginstaller banner * Create quota before _data dir for volumes * Packit: clarify secondary status in CI * Packit/RPM: Display upstream commit SHA in all rpm builds * podman run: fix --pids-limit -1 wrt runc * vendor: update github.com/go-jose/go-jose/v3 to v3.0.4 * chore(deps): update module github.com/go-jose/go-jose/v4 to v4.0.5 [security] * wire up --retry-delay for artifact pull * Revert "silence false positve from golangci-lint" * update golangci-lint to v1.64.4 * update golangci-lint to v1.64.2 * silence false positve from golangci-lint * cmd/podman: refactor Context handling * fix new usetesting lint issue * Packit/Copr: Fix `podman version` in rpm * Remove persist directory when cleaning up Conmon files * Bump to v5.4.1-dev * Bump to v5.4.0 * Update release notes for v5.4.0 final * In SQLite state, use defaults for empty-string checks * Bump FreeBSD version to 13.4 * docs: add v5.4 to API reference * Update rpm/podman.spec * RPM: set buildOrigin in LDFLAG * RPM: cleanup macro defs * Makefile: escape BUILD_ORIGIN properly * rootless: fix hang on s390x * Set Cirrus DEST_BRANCH appropriately to fix CI * Bump to v5.4.0-dev * Bump to v5.4.0-rc3 * Update release notes for v5.4.0-rc3 * Add BuildOrigin field to podman info * artifact: only allow single manifest * test/e2e: improve write/removeConf() * Add --noheading to artifact ls * Add --no-trunc to artifact ls * Add type and annotations to artifact add * pkg/api: honor cdi devices from the hostconfig * util: replace Walk with WalkDir * fix(pkg/rootless): avoid memleak during init() contructor. * Add `machine init --playbook` * RPM: include empty check to silence rpmlint * RPM: adjust qemu dependencies * Force use of iptables on Windows WSL * rpm: add attr as dependency for podman-tests * update gvproxy version * [v5.4] Bump Buildah to v1.39.0 * podman exec: correctly support detaching * libpod: remove unused ExecStartAndAttach() * [v5.4] Bump c/storage to v1.57.1, c/image v5.34.0, c/common v0.62.0 * Move detection of libkrun and intel * Prevent two podman machines running on darwin * Remove unnecessary error handling * Remove usused Kind() function * Bump to v5.4.0-dev * Bump to v5.4.0-rc2 * Update release notes for v5.4.0-rc2 * Safer use of `filepath.EvalSymlinks()` on Windows * error with libkrun on intel-based machines * chore(deps): update dependency pytest to v8.3.4 * test/buildah-bud: skip two new problematic tests on remote * Fix podman-restart.service when there are no containers * Avoid upgrading from v5.3.1 on Windows * Clean up after unexpectedly terminated build * system-tests: switch ls with getfattr for selinux tests * vendor latest c/{buildah,common,image,storage} * Makefile: Add validatepr description for 'make help' output * docs: Enhance podman build --secret documentation and add examples * docs: mount.md - idmapped mounts only work for root user * Define, and use, PodmanExitCleanlyWithOptions * Eliminate PodmanSystemdScope * Fix image ID query * Revert "Use the config digest to compare images loaded/pulled using different methods" * Update c/image after https://github.com/containers/image/pull/2613 * Update expected errors when pulling encrypted images * Eliminate PodmanExtraFiles * Introduce PodmanTestIntegration.PodmanWithOptions * Restructure use of options * Inline PodmanBase into callers * Pass all of PodmanExecOptions to various [mM]akeOptions functions * Turn PodmanAsUserBase into PodmanExecBaseWithOptions * Avoid indirect links through quadlet(5) * do not set the CreateCommand for API users * Add podman manifest rm --ignore * Bump to v5.4.0-dev * Bump to v5.4.0-rc1 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.8.2 * podman artifact * vendor latest c/{common,image,storage} * fix(deps): update module github.com/rootless-containers/rootlesskit/v2 to v2.3.2 * cirrus: bump macos machine test timeout * pkg/machine/e2e: improve podman.exe match * pkg/machine/e2e: improve "list machine from all providers" * Remove JSON tag from UseImageHosts in ContainerConfig * Set network ID if available during container inspect * Stop creating a patch for v5.3.1 upgrades on windows * compose docs: fix typo * Document kube-play CDI support * docs: Add quadlet debug method systemd-analyze * Replace instances of PodmanExitCleanly in play_kube_test.go * docs: add 'initialized' state to status filters * fix(deps): update module google.golang.org/protobuf to v1.36.3 * Switch all calls of assert.Nil to assert.NoError * Add --no-hostname option * Fix unescaping octal escape sequence in values of Quadlet unit files * Remove `.exe` suffix if any * Add kube play support for CDI resource allocation * add support to `;` for comments in unit files as per systemd documentation * Use PodmanExitCleanly in attach_test.go * Introduce PodmanTestIntegration.PodmanExitCleanly * chore(deps): update dependency setuptools to ~=75.8.0 * Add newer c/i to support artifacts * fix(deps): update module golang.org/x/tools to v0.29.0 * fix(deps): update module golang.org/x/net to v0.34.0 * specgenutil: Fix parsing of mount option ptmxmode * namespaces: allow configuring keep-id userns size * Update description for completion * Quadlet - make sure the /etc/containers/systemd/users is traversed in rootless * Document .build for Image .container option * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.9.1 * New VM Images * update golangci/golangci-lint to v1.63.4 * fix(deps): update module google.golang.org/protobuf to v1.36.2 * chore(deps): update dependency setuptools to ~=75.7.0 * Fixing ~/.ssh/identity handling * vendor latest c/common from main * fix(deps): update module github.com/shirou/gopsutil/v4 to v4.24.12 * fix(deps): update module github.com/opencontainers/runc to v1.2.4 * specgen: fix comment * Add hint to restart Podman machine to really accept new certificates * fix(deps): update module github.com/onsi/gomega to v1.36.2 * fix(deps): update module github.com/moby/term to v0.5.2 * Pass container hostname to netavark * Fix slirp4netns typo in podman-network.1.md * Add support t

Correctif disponible

Publication

2025-10-01T13:49:25Z

Mise à jour

2026-03-23T04:50:17.334412Z

Pile logicielle: system

Vérifiez votre serveur →