SUSE-SU-2025:20279-1

SUSE-SU-2025:20279-1 · Security update for podman

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

This update for podman fixes the following issues: - CVE-2023-45288: Fixed closing connection when receiving too many headers (bsc#1236507). - CVE-2024-11218: Fixed container breakout by using --jobs=2 and a race condition when building a malicious Containerfile (bsc#1236270). - CVE-2025-22869: Fixed Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239330). - CVE-2025-27144: Fixed Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237641). - CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (bsc#1231208). - CVE-2024-3727: Fixed digest type (bsc#1224112). - CVE-2024-1753: Fixed full container escape at build time (bsc#1221677). Other fixes: - Updated to version 5.2.5: * RPM: remove dup Provides * Packit: constrain koji and bodhi jobs to fedora package to avoid dupes * Validate the bind-propagation option to `--mount` * Updated Buildah to v1.37.4 * vendor: updated c/common to v0.60.4 * pkg/specgen: allow pasta when running inside userns * libpod: convert owner IDs only with :idmap * allow exposed sctp ports * libpod: setupNetNS() correctly mount netns * vendor: updated c/common to v0.60.3 * [skip-ci] Packit: split out ELN jobs and reuse fedora downstream targets * [skip-ci] Packit: Enable sidetags for bodhi updates * Updated gvisor-tap-vsock to 0.7.5 * CI: podman-machine: do not use cache registry * [CI:DOCS] Add v5.2.2 lib updates to RELEASE_NOTES.md * Update RELEASE_NOTES for v5.2.2 * [v5.2] Bump Buildah to v1.37.2, c/common v0.60.2, c/image v5.32.2 * [v5.2] golangci-lint: make darwin linting happy * [v5.2] golangci-lint: make windows linting happy * [v5.2] test/e2e: remove kernel version check * [v5.2] golangci-lint: remove most skip dirs * [v5.2] set !remote build tags where needed * [v5.2] update golangci-lint to 1.60.1 * Packit: update targets for propose-downstream * Create volume path before state initialization * Update Cirrus DEST_BRANCH * Bump to v5.2.2-dev * Bump to v5.2.1 * Update release notes for v5.2.1 * [v5.2] Add zstd:chunked test fix * [v5.2] Bump Buildah to v1.37.1, c/common v0.60.1, c/image v5.32.1 * libpod: reset state error on init * libpod: do not save expected stop errors in ctr state * libpod: fix broken saveContainerError() * Bump to v5.2.1-dev * Bump to v5.2.0 * Never skip checkout step in release workflow * Bump to v5.2.0-dev * Bump to v5.2.0-rc3 * Update release notes for v5.2.0-rc3 * Tweak versions in register_images.go * fix network cleanup flake in play kube * WIP: Fixes for vendoring Buildah * Add --compat-volumes option to build and farm build * Bump Buildah, c/storage, c/image, c/common * libpod: bind ports before network setup * pkg/api: do not leak config pointers into specgen * build: Update gvisor-tap-vsock to 0.7.4 * test/system: fix borken pasta interface name checks * test/system: fix bridge host.containers.internal test * CI: system tests: instrument to allow failure analysis * Use uploaded .zip for Windows action * RPM: podman-iptables.conf only on Fedora * Bump to v5.2.0-dev * Bump to v5.2.0-rc2 * Update release notes for v5.2.0-rc2 * test/e2e: fix ncat tests * libpod: add hidden env to set sqlite timeout * Add support for StopSignal in quadlet .container files * podman pod stats: fix race when ctr process exits * Update module github.com/vbauerster/mpb/v8 to v8.7.4 * libpod: correctly capture healthcheck output * Bump bundled krunkit to 0.1.2 * podman stats: fix race when ctr process exists * nc -p considered harmful * podman pod stats: fix pod rm race * podman ps: fix racy pod name query * system connection remove: use Args function to validate * pkg/machine/compression: skip decompress bar for empty file * nc -p considered harmful * podman system df: fix fix ErrNoSuchCtr/Volume race * podman auto-update: fix ErrNoSuchCtr race * Fix name for builder in farm connection * 700-play.bats: use unique pod/container/image/volume names * safename: consistent within same test, and, dashes * 700-kube.bats: refactor $PODMAN_TMPDIR/test.yaml * 700-play.bats: eliminate $testYaml * 700-play.bats: refactor clumsy yamlfile creation * 700-play.bats: move _write_test_yaml up near top * chore(deps): update dependency setuptools to v71 * Expand drop-in search paths * top-level (pod.d) * truncated (unit-.container.d) * Remove references and checks for --gpus * Do not crash on invalid filters * fix(deps): update module github.com/rootless-containers/rootlesskit/v2 to v2.2.0 * Bump to v5.2.0-dev * Bump to v5.2.0-rc1 * Keep the volume-driver flag deprecated * Vendor in latest containers(common, storage,image, buildah) * System tests: safe container/image/volume/etc names * Implement disable default mounts via command line * test: drop unmount for overlay * test: gracefully terminate server * libpod: shutdown Stop waits for handlers completion * libpod: cleanup store at shutdown * Add NetworkAlias= support to quadlet * cmd: call shutdown handler stop function * fix race conditions in start/attach logic * swagger: exlude new docker network types * vendor: bump c/storage * update to docker 27 * contrib: use a distinct --pull-option= for each flag * Update warning message when using external compose provider * Update module github.com/cyphar/filepath-securejoin to v0.3.0 * Ignore result of EvalSymlinks on ENOENT * test/upgrade: fix tests when netavark uses nftables * test/system: fix network reload test with nftables * test/e2e: rework some --expose tests * test: remove publish tests from e2e * CI: test nftables driver on fedora * CI: use local registry, part 3 of 3: for developers * CI: use local registry, part 2 of 3: fix tests * CI: use local registry, part 1 of 3: setup * CI: test composefs on rawhide * chore(deps): update module google.golang.org/grpc to v1.64.1 [security] * chore(deps): update dependency setuptools to ~=70.3.0 * Improve container filenname ambiguity. * containers/attach: Note bug around goroutine leak * Drop minikube CI test * add libkrun test docs * fix(deps): update module tags.cncf.io/container-device-interface to v0.8.0 * cirrus: check for header files in source code check * pkg/machine/e2e: run debug command only for macos * create runtime's worker queue before queuing any job * test/system: fix pasta host.containers.internal test * Visual Studio BuildTools as a MinGW alternative * SetupRootless(): only reexec when needed * pkg/rootless: simplify reexec for container code * cirrus: add missing test/tools to danger files * fix(deps): update module golang.org/x/tools to v0.23.0 * Windows Installer: switch to wix5 * fix(deps): update module golang.org/x/net to v0.27.0 * pkg/machine/e2e: print tests timings at the end * pkg/machine/e2e: run debug commands after init * pkg/machine/e2e: improve timeout handling * libpod: first delete container then cidfile * fix(deps): update module golang.org/x/term to v0.22.0 * System test fixes * cirrus.yml: automatic skips based on source * fix(deps): update module github.com/containers/ocicrypt to v1.2.0 * podman events: fix error race * chore(deps): update dependency setuptools to ~=70.2.0 * fix(deps): update module github.com/gorilla/schema to v1.4.1 [security] * Update CI VM images * pkg/machine/e2e: fix broken cleanup * pkg/machine/e2e: use tmp file for connections * test/system: fix podman --image-volume to allow tmpfs storage * CI: mount tmpfs for container storage * docs: --network remove missing leading sentence * specgen: parse devices even with privileged set * vendor: update c/storage * Remove the unused machine volume-driver * feat(quadlet): log option handling * Error when machine memory exceeds system memory * machine: Always use --log-file with gvproxy * CI: Bu

Fix available

Published

2025-04-22T13:50:31Z

Updated

2026-03-23T04:47:11.871842Z

Stack: system

Check your server →