VDB

RHSA-2025%3A1707

RHSA-2025%3A1707 PUBLISHED CVSS 8.600000381469727 HIGH

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.

Risk Scores

CVSS 3.1
8.600000381469727
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red Hatopenshift4/ose-machine-os-images-rhel9@sha256:eb570492a0b9401e114dda27726879558ebe66694c4155aeb573f3437d7b79d1_s390x as a component of Red Hat OpenShift Container Platform 4.16openshift4/ose-machine-os-images-rhel9@sha256:eb570492a0b9401e114dda27726879558ebe66694c4155aeb573f3437d7b79d1_s390x, *
Red Hatopenshift4/network-tools-rhel9@sha256:15e77dc4ab43138792ce5496dc56e4a93c82b54210b40f2c12d37c48847b7f93_arm64 as a component of Red Hat OpenShift Container Platform 4.16openshift4/network-tools-rhel9@sha256:15e77dc4ab43138792ce5496dc56e4a93c82b54210b40f2c12d37c48847b7f93_arm64, openshift4/network-tools-rhel9@sha256:15e77dc4ab43138792ce5496dc56e4a93c82b54210b40f2c12d37c48847b7f93_arm64
Red Hatopenshift4/ose-docker-registry-rhel9@sha256:a8987b583cfb9771d9526dd49bd46984d0b1ad6c5d60d081c226b3efff5ff2e9_amd64 as a component of Red Hat OpenShift Container Platform 4.16openshift4/ose-docker-registry-rhel9@sha256:a8987b583cfb9771d9526dd49bd46984d0b1ad6c5d60d081c226b3efff5ff2e9_amd64, openshift4/ose-docker-registry-rhel9@sha256:a8987b583cfb9771d9526dd49bd46984d0b1ad6c5d60d081c226b3efff5ff2e9_amd64
Red Hatopenshift4/ose-installer-artifacts-rhel9@sha256:a6e6febb4aceff2aed1c7acb74c1650d866c5e08e3b0dfc4ca8b09b5d361918f_amd64 as a component of Red Hat OpenShift Container Platform 4.16*, openshift4/ose-installer-artifacts-rhel9@sha256:a6e6febb4aceff2aed1c7acb74c1650d866c5e08e3b0dfc4ca8b09b5d361918f_amd64
Red Hatrhcos@sha256:ddc2fc6c2cbbd9ba58dc6c56e584b5209ea3e540ed73e5f1b82465978c1aaca0_x86_64 as a component of Red Hat OpenShift Container Platform 4.16rhcos@sha256:ddc2fc6c2cbbd9ba58dc6c56e584b5209ea3e540ed73e5f1b82465978c1aaca0_x86_64, rhcos@sha256:ddc2fc6c2cbbd9ba58dc6c56e584b5209ea3e540ed73e5f1b82465978c1aaca0_x86_64
Red Hatopenshift4/ose-baremetal-installer-rhel9@sha256:756779e233f2a58fd30ff48b7a2e9a13ee292b577a0e29a2b5867ccfe14b065d_amd64 as a component of Red Hat OpenShift Container Platform 4.16*, openshift4/ose-baremetal-installer-rhel9@sha256:756779e233f2a58fd30ff48b7a2e9a13ee292b577a0e29a2b5867ccfe14b065d_amd64
Red Hatopenshift4/ose-tools-rhel9@sha256:dd36c9f345eb61c038c17bc3fd47b270e8a7d2be51924feb3248f04df5592d67_s390x as a component of Red Hat OpenShift Container Platform 4.16*, *
Red Hatopenshift4/ose-console-rhel9@sha256:b7486d3993df1565a2016025fefde8dd05b82d55da64c5cb9e72588839b7b8b7_s390x as a component of Red Hat OpenShift Container Platform 4.16openshift4/ose-console-rhel9@sha256:b7486d3993df1565a2016025fefde8dd05b82d55da64c5cb9e72588839b7b8b7_s390x, openshift4/ose-console-rhel9@sha256:b7486d3993df1565a2016025fefde8dd05b82d55da64c5cb9e72588839b7b8b7_s390x
Red Hatopenshift4/ose-sdn-rhel9@sha256:0c69796c93d4ba96b8d110862e019f84e35c6a3934c1d325ac873c352c29aab2_s390x as a component of Red Hat OpenShift Container Platform 4.16*, openshift4/ose-sdn-rhel9@sha256:0c69796c93d4ba96b8d110862e019f84e35c6a3934c1d325ac873c352c29aab2_s390x
Red Hatopenshift4/ose-machine-config-rhel9-operator@sha256:f7979d27d61496655812cea5a26ad3ae8ccefd21e18a7e43572264896f18e3d3_amd64 as a component of Red Hat OpenShift Container Platform 4.16openshift4/ose-machine-config-rhel9-operator@sha256:f7979d27d61496655812cea5a26ad3ae8ccefd21e18a7e43572264896f18e3d3_amd64, openshift4/ose-machine-config-rhel9-operator@sha256:f7979d27d61496655812cea5a26ad3ae8ccefd21e18a7e43572264896f18e3d3_amd64
Red Hatopenshift4/ose-sdn-rhel9@sha256:def9b54157dc8dfadb575d8122f84f0fed30e1a320fba612eb80af5139131cab_ppc64le as a component of Red Hat OpenShift Container Platform 4.16*, openshift4/ose-sdn-rhel9@sha256:def9b54157dc8dfadb575d8122f84f0fed30e1a320fba612eb80af5139131cab_ppc64le
Red Hatopenshift4/ose-machine-os-images-rhel9@sha256:5ab13956e0feb2a64155ba83cf53d1649ce246c6d578ef03055320e4ed95fc3b_arm64 as a component of Red Hat OpenShift Container Platform 4.16openshift4/ose-machine-os-images-rhel9@sha256:5ab13956e0feb2a64155ba83cf53d1649ce246c6d578ef03055320e4ed95fc3b_arm64, openshift4/ose-machine-os-images-rhel9@sha256:5ab13956e0feb2a64155ba83cf53d1649ce246c6d578ef03055320e4ed95fc3b_arm64
Red Hatopenshift4/ose-kube-proxy-rhel9@sha256:e38e0dfb382665d0cd959fd9ec67475a37ac306ca8c0d5db84419fb871611e66_s390x as a component of Red Hat OpenShift Container Platform 4.16*, *
Red Hatopenshift4/ose-docker-registry-rhel9@sha256:1451d945be3e47d75a86538ce725bafcae572dc95661cdb68b81f5cab8575f7c_arm64 as a component of Red Hat OpenShift Container Platform 4.16openshift4/ose-docker-registry-rhel9@sha256:1451d945be3e47d75a86538ce725bafcae572dc95661cdb68b81f5cab8575f7c_arm64, openshift4/ose-docker-registry-rhel9@sha256:1451d945be3e47d75a86538ce725bafcae572dc95661cdb68b81f5cab8575f7c_arm64
Red Hatopenshift4/ose-networking-console-plugin-rhel9@sha256:862ecaa2416f708959191c799526b23066068630f72609923b1921877b212944_ppc64le as a component of Red Hat OpenShift Container Platform 4.16openshift4/ose-networking-console-plugin-rhel9@sha256:862ecaa2416f708959191c799526b23066068630f72609923b1921877b212944_ppc64le, openshift4/ose-networking-console-plugin-rhel9@sha256:862ecaa2416f708959191c799526b23066068630f72609923b1921877b212944_ppc64le
Red Hatopenshift4/ose-installer-artifacts-rhel9@sha256:b41f245596302660e7dfc057301bb0dc5bc9565851e3f1b204fe8f9c7593df61_ppc64le as a component of Red Hat OpenShift Container Platform 4.16openshift4/ose-installer-artifacts-rhel9@sha256:b41f245596302660e7dfc057301bb0dc5bc9565851e3f1b204fe8f9c7593df61_ppc64le, openshift4/ose-installer-artifacts-rhel9@sha256:b41f245596302660e7dfc057301bb0dc5bc9565851e3f1b204fe8f9c7593df61_ppc64le
Red Hatopenshift4/ose-installer-artifacts-rhel9@sha256:01cc4527ad7824ca20bd38414d77df96b916ddedadcd6106daad27e6f3dd22dc_arm64 as a component of Red Hat OpenShift Container Platform 4.16openshift4/ose-installer-artifacts-rhel9@sha256:01cc4527ad7824ca20bd38414d77df96b916ddedadcd6106daad27e6f3dd22dc_arm64, openshift4/ose-installer-artifacts-rhel9@sha256:01cc4527ad7824ca20bd38414d77df96b916ddedadcd6106daad27e6f3dd22dc_arm64
Red Hatopenshift4/ose-installer-altinfra-rhel9@sha256:160fe83a92c07fa149e5324d2562fc2cd2958ac1f5ccc7693c764274577e0fd1_amd64 as a component of Red Hat OpenShift Container Platform 4.16*, *
Red Hatopenshift4/ose-agent-installer-api-server-rhel9@sha256:39de51fd026ef2a3b950bb221fd9a8a6173b294ecc27568b076e9fa751b03aa0_amd64 as a component of Red Hat OpenShift Container Platform 4.16openshift4/ose-agent-installer-api-server-rhel9@sha256:39de51fd026ef2a3b950bb221fd9a8a6173b294ecc27568b076e9fa751b03aa0_amd64, openshift4/ose-agent-installer-api-server-rhel9@sha256:39de51fd026ef2a3b950bb221fd9a8a6173b294ecc27568b076e9fa751b03aa0_amd64
Red Hatopenshift4/ose-machine-os-images-rhel9@sha256:51a4397f8eef64c52e7c488fd2ce62570f8e5f8e71c272fbba14ac5bb95ea40c_amd64 as a component of Red Hat OpenShift Container Platform 4.16openshift4/ose-machine-os-images-rhel9@sha256:51a4397f8eef64c52e7c488fd2ce62570f8e5f8e71c272fbba14ac5bb95ea40c_amd64, openshift4/ose-machine-os-images-rhel9@sha256:51a4397f8eef64c52e7c488fd2ce62570f8e5f8e71c272fbba14ac5bb95ea40c_amd64

…and 68 more

Timeline

  • Feb 27, 2025 CVE Published
  • Apr 24, 2026 Distribution Patch
  • Apr 24, 2026 Distribution Patch
  • Apr 24, 2026 Security Advisory
  • Apr 24, 2026 Security Advisory
  • Apr 29, 2026 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›