Description
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
CVSS Metrics
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Attack Vector
- local
- Complexity
- low
- Privileges
- low
- User Action
- none
- Scope
- unchanged
- Confidentiality
- high
- Integrity
- high
- Availability
- none
- Weaknesses
- CWE-842CWE-863
Metadata
- Primary Vendor
- PODMAN_PROJECT
- Published
- 9/13/2022
- Last Modified
- 6/5/2025
- Source
- NIST NVD
- Note: Verify all details with official vendor sources before applying patches.
Affected Products
podman_project : podmanredhat : openshift_container_platformredhat : openshift_container_platformredhat : enterprise_linuxredhat : enterprise_linuxredhat : enterprise_linux
AI-Powered Remediation
Generate remediation guidance or a C-suite brief for this vulnerability.