Threats Tagged 'ghsa-2cvf-wqm6-wr9g'

Podman versions from 4.4.0 up to but not including 5.8.8, and from 6.0.0 up to but not including 6.1.3, contain a vulnerability where podman run treats images with the io.podman.annotations.checkpoint.runtime.name annotation as checkpoints. This causes podman to ignore user-supplied container creation restrictions such as --cap-drop=ALL, potentially allowing weaker sandbox settings and capabilities. Rootless containers are not affected. The issue is fixed in versions 5.8.8 and 6.1.3.