High severity · published Sep 1, 2022
CVE-2022-2738
The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-8945,…
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-8945, which was previously fixed via RHSA-2020:2117. This issue could possibly be used to crash or cause potential code execution in Go applications that use the Go GPGME wrapper library, under certain conditions, during GPG signature verification.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux Server · Redhat
7.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
7.0 · source: NVD
PO
Podman · Podman Project
1.6.4-32.el7_9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2738
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2738
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-2738
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2116923
More from Podman
8.8
CVE-2019-25067
A vulnerability, which was classified as critical, was found in Podman and Varlink 1.5.1
8.8
CVE-2022-1227
A privilege escalation flaw was found in Podman
7.8
CVE-2026-33414
PowerShell Command Injection in Podman HyperV Machine
7.7
CVE-2024-3056
A flaw was found in Podman
7.5
CVE-2026-57231
Podman: Malformed Image can trick podman run into leaking host environment variables into the container