podman (SUSE:Linux Enterprise Module for Containers 15 SP3) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Containers 15 SP3 package podman, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (11)

• CVE-2022-1227 — CVSS 8.8 (high): A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this…
• CVE-2022-21698 — CVSS 7.5 (high): client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling…
• CVE-2022-27191 — CVSS 7.5 (high): The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain…
• CVE-2022-2989 — CVSS 7.1 (high): An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or…
• CVE-2021-4024 — CVSS 6.5 (medium): A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process)…
• CVE-2021-20291 — CVSS 6.5 (medium): A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each…
• CVE-2020-15157 — CVSS 6.1 (medium): In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container…
• CVE-2021-20199 — CVSS 5.9 (medium): Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts…
• CVE-2021-3602 — CVSS 5.5 (medium): An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds…
• CVE-2020-14370 — CVSS 5.3 (medium): An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or…
• CVE-2021-41190 — CVSS 3.0 (low): The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI…