PT-2022-18404 · Red Hat · Podman

Mauro Matteo Cascella · Published 2022-09-01 · Updated 2023-02-13 · CVE-2022-2738

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions podman versions prior to the version fixed via RHSA-2020:2117

Description The issue could potentially be used to crash or cause code execution in Go applications using the Go GPGME wrapper library under certain conditions during GPG signature verification.

Recommendations For versions prior to the one fixed via RHSA-2020:2117, update to a version that includes the fix for the issue.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2022-2738

RHSA-2022:6119

Affected Products

Podman

References · 8

• https://linux.oracle.com/errata/ELSA-2022-20240.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2738 · Security Note
• https://access.redhat.com/security/cve/CVE-2022-2738 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2738 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2116923 · Vendor Advisory
• https://t.me/cibsecurity/49198 · Telegram Post
• https://t.me/cvenotify/35604 · Telegram Post
• https://t.me/cvenotify/44157 · Telegram Post