Security update for podman SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3819-1 Final 1 1 2022-10-31T11:52:34Z current 2022-10-31T11:52:34Z 2022-10-31T11:52:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for podman This update for podman fixes the following issues: - CVE-2022-2989: Fixed possible information disclosure and modification (bsc#1202809). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-3819,SUSE-SLE-Module-Containers-15-SP3-2022-3819,SUSE-SUSE-MicroOS-5.1-2022-3819,SUSE-SUSE-MicroOS-5.2-2022-3819,SUSE-Storage-7.1-2022-3819,openSUSE-Leap-Micro-5.2-2022-3819,openSUSE-SLE-15.3-2022-3819 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223819-1/ Link for SUSE-SU-2022:3819-1 https://lists.suse.com/pipermail/sle-security-updates/2022-October/012774.html E-Mail link for SUSE-SU-2022:3819-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1202809 SUSE Bug 1202809 https://www.suse.com/security/cve/CVE-2022-2989/ SUSE CVE CVE-2022-2989 page SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Containers 15 SP3 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 podman-3.4.7-150300.9.12.1 podman-cni-config-3.4.7-150300.9.12.1 podman-docker-3.4.7-150300.9.12.1 podman-remote-3.4.7-150300.9.12.1 podman-3.4.7-150300.9.12.1 as a component of SUSE Enterprise Storage 7.1 podman-3.4.7-150300.9.12.1 as a component of SUSE Linux Enterprise Micro 5.1 podman-cni-config-3.4.7-150300.9.12.1 as a component of SUSE Linux Enterprise Micro 5.1 podman-3.4.7-150300.9.12.1 as a component of SUSE Linux Enterprise Micro 5.2 podman-cni-config-3.4.7-150300.9.12.1 as a component of SUSE Linux Enterprise Micro 5.2 podman-3.4.7-150300.9.12.1 as a component of SUSE Linux Enterprise Module for Containers 15 SP3 podman-cni-config-3.4.7-150300.9.12.1 as a component of SUSE Linux Enterprise Module for Containers 15 SP3 podman-3.4.7-150300.9.12.1 as a component of openSUSE Leap 15.3 podman-cni-config-3.4.7-150300.9.12.1 as a component of openSUSE Leap 15.3 podman-3.4.7-150300.9.12.1 as a component of openSUSE Leap Micro 5.2 podman-cni-config-3.4.7-150300.9.12.1 as a component of openSUSE Leap Micro 5.2 An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container. CVE-2022-2989 SUSE Enterprise Storage 7.1:podman-3.4.7-150300.9.12.1 SUSE Linux Enterprise Micro 5.1:podman-3.4.7-150300.9.12.1 SUSE Linux Enterprise Micro 5.1:podman-cni-config-3.4.7-150300.9.12.1 SUSE Linux Enterprise Micro 5.2:podman-3.4.7-150300.9.12.1 SUSE Linux Enterprise Micro 5.2:podman-cni-config-3.4.7-150300.9.12.1 SUSE Linux Enterprise Module for Containers 15 SP3:podman-3.4.7-150300.9.12.1 SUSE Linux Enterprise Module for Containers 15 SP3:podman-cni-config-3.4.7-150300.9.12.1 openSUSE Leap 15.3:podman-3.4.7-150300.9.12.1 openSUSE Leap 15.3:podman-cni-config-3.4.7-150300.9.12.1 openSUSE Leap Micro 5.2:podman-3.4.7-150300.9.12.1 openSUSE Leap Micro 5.2:podman-cni-config-3.4.7-150300.9.12.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223819-1/ https://www.suse.com/security/cve/CVE-2022-2989.html CVE-2022-2989 https://bugzilla.suse.com/1202809 SUSE Bug 1202809