CVE-2022-2739 Information disclosure in podman
An attacker can access sensitive information stored in environment variables due to a missing security patch in the Podman container engine.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-2739?
CVE-2022-2739 is a medium-severity vulnerability in Redhat Enterprise Linux Server, published on 1 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-14370, which was previously fixed via RHSA-2020:5056. This issue could possibly allow an attacker to gain access to sensitive information stored in environment variables.
Which versions are affected by CVE-2022-2739?
It affects 3 products.
Products include Podman Project Podman, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.
How do I fix CVE-2022-2739?
Apply the vendor's patch.
Is CVE-2022-2739 being exploited?
There is no known exploitation of CVE-2022-2739 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux Server
- CVE-2026-57231 Podman: Malformed Image can trick podman run into leaking host environment variables into the container
- CVE-2022-2738 Use after free in podman
- CVE-2022-2989 Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification
- CVE-2021-20188 Improper Authorization in github.com/containers/libpod
- CVE-2023-0778 Podman Time-of-check Time-of-use (TOCTOU) Race Condition
Sources
Also known as GHSA-cqvr-p82r-76m9.