Stay Connected:

CVE-2025-9566

CVE Details

Release Date:2025-09-05
Impact:Important What is this?

Description


There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1

See more information about CVE-2025-9566 from MITRE CVE dictionary and NIST NVD


NOTE: The following CVSS metrics and score provided are preliminary and subject to review.


CVSS v3 metrics

Base Score: 8.1
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Version: 3.1
Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: High
Availability Impact: High

Errata information


PlatformErrataRelease Date
Oracle Linux version 10 (podman) ELSA-2025-159012025-09-16
Oracle Linux version 8 (aardvark-dns) ELSA-2025-159042025-09-17
Oracle Linux version 8 (buildah) ELSA-2025-159042025-09-17
Oracle Linux version 8 (cockpit-podman) ELSA-2025-159042025-09-17
Oracle Linux version 8 (conmon) ELSA-2025-159042025-09-17
Oracle Linux version 8 (container-selinux) ELSA-2025-159042025-09-17
Oracle Linux version 8 (containernetworking-plugins) ELSA-2025-159042025-09-17
Oracle Linux version 8 (containers-common) ELSA-2025-159042025-09-17
Oracle Linux version 8 (criu) ELSA-2025-159042025-09-17
Oracle Linux version 8 (crun) ELSA-2025-159042025-09-17
Oracle Linux version 8 (fuse-overlayfs) ELSA-2025-159042025-09-17
Oracle Linux version 8 (libslirp) ELSA-2025-159042025-09-17
Oracle Linux version 8 (netavark) ELSA-2025-159042025-09-17
Oracle Linux version 8 (oci-seccomp-bpf-hook) ELSA-2025-159042025-09-17
Oracle Linux version 8 (podman) ELSA-2025-159042025-09-17
Oracle Linux version 8 (python-podman) ELSA-2025-159042025-09-17
Oracle Linux version 8 (runc) ELSA-2025-159042025-09-17
Oracle Linux version 8 (skopeo) ELSA-2025-159042025-09-17
Oracle Linux version 8 (slirp4netns) ELSA-2025-159042025-09-17
Oracle Linux version 8 (udica) ELSA-2025-159042025-09-17
Oracle Linux version 9 (podman) ELSA-2025-159002025-09-16


This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections:

software.hardware.complete
Subscribe | Careers | Contact Us | Legal Notices | Terms of Use | Your Privacy Rights