Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Fedora 41 podman Update FEDORA-2025-908dfe95f6 critical: Container Breakout

fedora
Calendar Grey January 25, 2025
Dist Fedora Esm H88
Ubuntu 23.04 enhances LXD, Docker, and image-tools tackling CVE-2024-11219 with essential security upgrades.
Security fix for CVE-2024-11218 - fixed in buildah 1.38.1, podman 5.3.2 Automatic update for buildah-1.38.1-1.fc41, containers-common-0.61.1-1.fc41, podman-5.3.2-1.fc41

Summary

podman (Pod Manager) is a fully featured container engine that is a simple

daemonless tool. podman provides a Docker-CLI comparable command line that

eases the transition from other container engines and allows the management of

pods, containers and images. Simply put: alias docker=podman.

Most podman commands can be run as a regular user, without requiring

additional privileges.

podman uses Buildah(1) internally to create container images.

Both tools share image (not container) storage, hence each can use or

manipulate images (but not containers) created by the other.

Update Information:

Security fix for CVE-2024-11218 - fixed in buildah 1.38.1, podman 5.3.2 Automatic update for buildah-1.38.1-1.fc41, containers-common-0.61.1-1.fc41, podman-5.3.2-1.fc41. Changelog for buildah * Tue Jan 21 2025 Packit - 2:1.38.1-1 - Update to 1.38.1 upstream release Changelog for containers-common * Thu Jan 16 2025 Packit - 5:0.61.1-1 - Update to 0.61.1 upstream release Changelog for podman * Wed Jan 22 2025 Packit - 5:5.3.2-1 - Update to 5.3.2 upstream release * Wed Jan 22 2025 Lokesh Mandvekar - 5:5.3.1-4 - remove patch merged in upcoming upstream release * Fri Jan 17 2025 Mikhail Gavrilov - 5:5.3.1-3 - apply MR https://github.com/containers/storage/pull/2193 * Wed Nov 27 2024 Lokesh Mandvekar - 5:5.3.1-2 - remove unused patch apply MR https://github.com/containers/storage/pull/2193

Topics%20covered

Topics Covered

security advisory fedora update buildah podman CVE-2024-11218

Change Log

* Wed Jan 22 2025 Packit - 5:5.3.2-1 - Update to 5.3.2 upstream release * Wed Jan 22 2025 Lokesh Mandvekar - 5:5.3.1-4 - remove patch merged in upcoming upstream release * Fri Jan 17 2025 Mikhail Gavrilov - 5:5.3.1-3 - apply MR https://github.com/containers/storage/pull/2193 * Wed Nov 27 2024 Lokesh Mandvekar - 5:5.3.1-2 - remove unused patch

References


[ 1 ] Bug #2326231 - CVE-2024-11218 podman: buildah: Container breakout by using --jobs=2 and a race condition when building a malicious Containerfile https://bugzilla.redhat.com/show_bug.cgi?id=2326231

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-908dfe95f6' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: podman
Product: Fedora 41
Version: 5.3.2
Release: 1.fc41
URL: https://podman.io/
Summary: Manage Pods, Containers and Container Images

Topics%20covered

Topics Covered

security advisory fedora update buildah podman CVE-2024-11218

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here