{"document":{"aggregate_severity":{"namespace":"https://www.suse.com/support/security/rating/","text":"important"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"text":"Copyright 2024 SUSE LLC. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"summary","text":"Security update for podman","title":"Title of the patch"},{"category":"description","text":"This update for podman fixes the following issues:\n\nUpdate to version 4.4.4:\n\n  * libpod: always use direct mapping\n  * macos pkginstaller: do not fail when podman-mac-helper fails\n  * podman-mac-helper: install: do not error if already installed\n\n- podman.spec: Bump required version for libcontainers-common (bsc#1209495)\n\nUpdate to version 4.4.3:\n\n  * compat: /auth: parse server address correctly\n  * vendor github.com/containers/common@v0.51.1\n  * pkginstaller: bump Qemu to version 7.2.0\n  * podman machine: Adjust Chrony makestep config\n  * [v4.4] fix --health-on-failure=restart in transient unit\n  * podman logs passthrough driver support --cgroups=split\n  * journald logs: simplify entry parsing\n  * podman logs: read journald with passthrough\n  * journald: remove initializeJournal()\n  * netavark: only use aardvark ip as nameserver\n  * compat API: network create return 409 for duplicate\n  * fix 'podman logs --since --follow' flake\n  * system service --log-level=trace: support hijack\n  * podman-mac-helper: exit 1 on error\n  * bump golang.org/x/net to v0.8.0\n  * Fix package restore\n  * Quadlet - use the default runtime\n\nUpdate to version 4.4.2:\n\n  * Revert 'CI: Temporarily disable all AWS EC2-based tasks'\n  * kube play: only enforce passthrough in Quadlet\n  * Emergency fix for man pages: check for broken includes\n  * CI: Temporarily disable all AWS EC2-based tasks\n  * quadlet system tests: add useful defaults, logging\n  * volume,container: chroot to source before exporting content\n  * install sigproxy before start/attach\n  * Update to c/image 5.24.1\n  * events + container inspect test: RHEL fixes\n\n- podman.spec: add `crun` requirement for quadlet\n- podman.spec: set PREFIX at build stage (bsc#1208510)\n\n- CVE-2023-0778: Fixed symlink exchange attack in podman export volume  (bsc#1208364)\n\nUpdate to version 4.4.1:\n\n  * kube play: do not teardown unconditionally on error\n  * Resolve symlink path for qemu directory if possible\n  * events: document journald identifiers\n  * Quadlet: exit 0 when there are no files to process\n  * Cleanup podman-systemd.unit file\n  * Install podman-systemd.unit  man page, make quadlet discoverable\n  * Add missing return after errors\n  * oci: bind mount /sys with --userns=(auto|pod:)\n  * docs: specify order preference for FROM\n  * Cirrus: Fix & remove GraphQL API tests\n  * test: adapt test to work on cgroupv1\n  * make hack/markdown-preprocess parallel-safe\n  * Fix default handling of pids-limit\n  * system tests: fix volume exec/noexec test\n\nUpdate to version 4.4.0:\n\n  * Emergency fix for RHEL8 gating tests\n  * Do not mount /dev/tty into rootless containers\n  * Fixes port collision issue on use of --publish-all\n  * Fix usage of absolute windows paths with --image-path\n  * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux\n  * podman-events: document verbose create events\n  * Making gvproxy.exe optional for building Windows installer\n  * Add gvproxy to Windows packages\n  * Match VT device paths to be blocked from mounting exactly\n  * Clean up more language for inclusiveness\n  * Set runAsNonRoot=true in gen kube\n  * quadlet: Add device support for .volume files\n  * fix: running check error when podman is default in wsl\n  * fix: don't output 'ago' when container is currently up and running\n  * journald: podman logs only show logs for current user\n  * journald: podman events only show events for current user\n  * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml)\n  * DB: make loading container states optional\n  * ps: do not sync container\n  * Allow --device-cgroup-rule to be passed in by docker API\n  * Create release notes for v4.4.0\n  * Cirrus: Update operating branch\n  * fix APIv2 python attach test flake\n  * ps: query health check in batch mode\n  * make example volume import, not import volume\n  * Correct output when inspecting containers created with --ipc\n  * Vendor containers/(storage, image, common, buildah)\n  * Get correct username in pod when using --userns=keep-id\n  * ps: get network data in batch mode\n  * build(deps): bump github.com/onsi/gomega from 1.25.0 to 1.26.0\n  * add hack/perf for comparing two container engines\n  * systems: retrofit dns options test to honor other search domains\n  * ps: do not create copy of container config\n  * libpod: set search domain independently of nameservers\n  * libpod,netavark: correctly populate /etc/resolv.conf with custom dns server\n  * podman: relay custom DNS servers to network stack\n  * (fix) mount_program is in storage.options.overlay\n  * Change example target to default in doc\n  * network create: do not allow `default` as name\n  * kube-play: add support for HostPID in podSpec\n  * build(deps): bump github.com/docker/docker\n  * Let's see if #14653 is fixed or not\n  * Add support for podman build --group-add\n  * vendor in latests containers/(storage, common, build, image)\n  * unskip network update test\n  * do not install swagger by default\n  * pasta: skip 'Local forwarder, IPv4' test\n  * add testbindings Makefile target\n  * update CI images to include pasta\n  * [CI:DOCS] Add CNI deprecation notices to documentation\n  * Cirrus: preserve podman-server logs\n  * waitPidStop: reduce sleep time to 10ms\n  * StopContainer: return if cleanup process changed state\n  * StopSignal: add a comment\n  * StopContainer: small refactor\n  * waitPidStop: simplify code\n  * e2e tests: reenable long-skipped build test\n  * Add openssh-clients to podmanimage\n  * Reworks Windows smoke test to tunnel through interactive session.\n  * fix bud-multiple-platform-with-base-as-default-arg flake\n  * Remove ReservedAnnotations from kube generate specification\n  * e2e: update test/README.md\n  * e2e: use isRootless() instead of rootless.IsRootless()\n  * Cleanup documentation on --userns=auto\n  * Vendor in latest c/common\n  * sig-proxy system test: bump timeout\n  * build(deps): bump github.com/containernetworking/plugins\n  * rootless: rename auth-scripts to preexec-hooks\n  * Docs: version-check updates\n  * commit: use libimage code to parse changes\n  * [CI:DOCS] Remove experimental mac tutorial\n  * man: Document the interaction between --systemd and --privileged\n  * Make rootless privileged containers share the same tty devices as rootfull ones\n  * container kill: handle stopped/exited container\n  * Vendor in latest containers/(image,ocicrypt)\n  * add a comment to container removal\n  * Vendor in latest containers/storage\n  * Cirrus: Run machine tests on PR merge\n  * fix flake in kube system test\n  * kube play: complete container spec\n  * E2E Tests: Use inspect instead of actual data to avoid UDP flake\n  * Use containers/storage/pkg/regexp in place of regexp\n  * Vendor in latest containers/storage\n  * Cirrus: Support using updated/latest NV/AV in PRs\n  * Limit replica count to 1 when deploying from kubernetes YAML\n  * Set StoppedByUser earlier in the process of stopping\n  * podman-play system test: refactor\n  * network: add support for podman network update and --network-dns-server\n  * service container: less verbose error logs\n  * Quadlet Kube - add support for PublishPort key\n  * e2e: fix systemd_activate_test\n  * Compile regex on demand not in init\n  * [docker compat] Don't overwrite the NetworkMode if containers.conf overrides netns.\n  * E2E Test: Play Kube set deadline to connection to avoid hangs\n  * Only prevent VTs to be mounted inside privileged systemd containers\n  * e2e: fix play_kube_test\n  * Updated error message for supported VolumeSource types\n  * Introduce pkg retry logic in win installer task\n  * logformatter: include base SHA, with history link\n  * Network tests: ping redhat.com, not podman.io\n  * cobra: move engine shutdown to Execute\n  * Updated options for QEMU on Windows hosts\n  * Update Mac installer to use gvproxy v0.5.0\n  * podman: podman rm -f doesn't leave processes\n  * oci: check for valid PID before kill(pid, 0)\n  * linux: add /sys/fs/cgroup if /sys is a bind mount\n  * Quadlet: Add support for ConfigMap key in Kube section\n  * remove service container _after_ pods\n  * Kube Play - allow setting and overriding published host ports\n  * oci: terminate all container processes on cleanup\n  * Update win-sshproxy to 0.5.0 gvisor tag\n  * Vendor in latest containers/common\n  * Fix a potential defer logic error around locking\n  * logformatter: nicer formatting for bats failures\n  * logformatter: refactor verbose line-print\n  * e2e tests: stop using UBI images\n  * k8s-file: podman logs --until --follow exit after time\n  * journald: podman logs --until --follow exit after time\n  * journald: seek to time when --since is used\n  * podman logs: journald fix --since and --follow\n  * Preprocess files in UTF-8 mode\n  * Vendor in latest containers/(common, image, storage)\n  * Switch to C based msi hooks for win installer\n  * hack/bats: improve usage message\n  * hack/bats: add --remote option\n  * hack/bats: fix root/rootless logic\n  * Describe copy volume options\n  * Support sig-proxy for podman-remote attach and start\n  * libpod: fix race condition rm'ing stopping containers\n  * e2e: fix run_volume_test\n  * Add support for Windows ARM64\n  * Add shared --compress to man pages\n  * Add container error message to ContainerState\n  * Man page checker: require canonical name in SEE ALSO\n  * system df: improve json output code\n  * kube play: fix the error logic with --quiet\n  * System tests: quadlet network test\n  * Fix: List container with volume filter\n  * adding -dryrun flag\n  * Quadlet Container: Add support for EnvironmentFile and EnvironmentHost\n  * Kube Play: use passthrough as the default log-driver if service-container is set\n  * System tests: add missing cleanup\n  * System tests: fix unquoted question marks\n  * Build and use a newer systemd image\n  * Quadlet Network - Fix the name of the required network service\n  * System Test Quadlet - Volume dependency test did not test the dependency\n  * fix `podman system connection - tcp` flake\n  * vendor: bump c/storage to a747b27\n  * Fix instructions about setting storage driver on command-line\n  * Test README - point users to hack/bats\n  * System test: quadlet kube basic test\n  * Fixed `podman update --pids-limit`\n  * podman-remote,bindings: trim context path correctly when its emptydir\n  * Quadlet Doc: Add section for .kube files\n  * e2e: fix containers_conf_test\n  * Allow '/' to prefix container names to match Docker\n  * Remove references to qcow2\n  * Fix typos in man page regarding transient storage mode.\n  * make: Use PYTHON var for .install.pre-commit\n  * Add containers.conf read-only flag support\n  * Explain that relabeling/chowning of volumes can take along time\n  * events: support 'die' filter\n  * infra/abi: refactor ContainerRm\n  * When in transient store mode, use rundir for bundlepath\n  * quadlet: Support Type=oneshot container files\n  * hacks/bats: keep QUADLET env var in test env\n  * New system tests for conflicting options\n  * Vendor in latest containers/(buildah, image, common)\n  * Output Size and Reclaimable in human form for json output\n  * podman service: close duplicated /dev/null fd\n  * ginkgo tests: apply ginkgolinter fixes\n  * Add support for hostPath and configMap subpath usage\n  * export: use io.Writer instead of file\n  * rootless: always create userns with euid != 0\n  * rootless: inhibit copy mapping for euid != 0\n  * pkg/domain/infra/abi: introduce `type containerWrapper`\n  * vendor: bump to buildah ca578b290144 and use new cache API\n  * quadlet: Handle booleans that have defaults better\n  * quadlet: Rename parser.LookupBoolean to LookupBooleanWithDefault\n  * Add podman-clean-transient.service service\n  * Stop recording annotations set to false\n  * Unify --noheading and -n to be consistent on all commands\n  * pkg/domain/infra/abi: add `getContainers`\n  * Update vendor of containters/(common, image)\n  * specfile: Drop user-add depedency from quadlet subpackage.\n  * quadlet: Default BINDIR to /usr/bin if tag not specified\n  * Quadlet: add network support\n  * Add comment for jsonMarshal command\n  * Always allow pushing from containers-storage\n  * libpod: move NetNS into state db instead of extra bucket\n  * Add initial system tests for quadlets\n  * quadlet: Add --user option\n  * libpod: remove CNI word were no longer applicable\n  * libpod: fix header length in http attach with logs\n  * podman-kube@ template: use `podman kube`\n  * build(deps): bump github.com/docker/docker\n  * wait: add --ignore option\n  * qudlet: Respect $PODMAN env var for podman binary\n  * e2e: Add assert-key-is-regex check to quadlet e2e testsuite\n  * e2e: Add some assert to quadlet test to make sure testcases are sane\n  * remove unmapped ports from inspect port bindings\n  * update podman-network-create for clarity\n  * Vendor in latest containers/common with default capabilities\n  * pkg/rootless: Change error text ...\n  * rootless: add cli validator\n  * rootless: define LIBEXECPODMAN\n  * doc: fix documentation for idmapped mounts\n  * bump golangci-lint to v1.50.1\n  * build(deps): bump github.com/onsi/gomega from 1.24.1 to 1.24.2\n  * [CI:DOCS] podman-mount: s/umount/unmount/\n  * create/pull --help: list pull policies\n  * Network Create: Add --ignore flag to support idempotent script\n  * Make qemu security model none\n  * libpod: use OCI idmappings for mounts\n  * stop reporting errors removing containers that don't exist\n  * test: added test from wait endpoint with to long label\n  * quadlet: Default VolatileTmp to off\n  * build(deps): bump github.com/ulikunitz/xz from 0.5.10 to 0.5.11\n  * docs/options/ipc: fix list syntax\n  * Docs: Add dedicated DOWNLOAD doc w/ links to bins\n  * Make a consistently-named windows installer\n  * checkpoint restore: fix --ignore-static-ip/mac\n  * add support for subpath in play kube for named volumes\n  * build(deps): bump golang.org/x/net from 0.2.0 to 0.4.0\n  * golangci-lint: remove three deprecated linters\n  * parse-localbenchmarks: separate standard deviation\n  * build(deps): bump golang.org/x/term from 0.2.0 to 0.3.0\n  * podman play kube support container startup probe\n  * Add podman buildx version support\n  * Cirrus: Collect benchmarks on machine instances\n  * Cirrus: Remove escape codes from log files\n  * [CI:DOCS] Clarify secret target behavior\n  * Fix typo on network docs\n  * podman-remote build add --volume support\n  * remote: allow --http-proxy for remote clients\n  * Cleanup kube play workloads if error happens\n  * health check: ignore dependencies of transient systemd units/timers\n  * fix: event read from syslog\n  * Fixes secret (un)marshaling for kube play.\n  * Remove 'you' from man pages\n  * build(deps): bump golang.org/x/tools from 0.3.0 to 0.4.0 in /test/tools\n  * [CI:DOCS] test/README.md: run tests with podman-remote\n  * e2e: keeps the http_proxy value\n  * Makefile: Add podman-mac-helper to darwin client zip\n  * test/e2e: enable 'podman run with ipam none driver' for nv\n  * [skip-ci] GHA/Cirrus-cron: Fix execution order\n  * kube sdnotify: run proxies for the lifespan of the service\n  * Update containers common package\n  * podman manpage: Use man-page links instead of file names\n  * e2e: fix e2e tests in proxy environment\n  * Fix test\n  * disable healthchecks automatically on non systemd systems\n  * Quadlet Kube: Add support for userns flag\n  * [CI:DOCS] Add warning about --opts,o with mount's -o\n  * Add podman system prune --external\n  * Add some tests for transient store\n  * runtime: In transient_store mode, move bolt_state.db to rundir\n  * runtime: Handle the transient store options\n  * libpod: Move the creation of TmpDir to an earlier time\n  * network create: support '-o parent=XXX' for ipvlan\n  * compat API: allow MacAddress on container config\n  * Quadlet Kube: Add support for relative path for YAML file\n  * notify k8s system test: move sending message into exec\n  * runtime: do not chown idmapped volumes\n  * quadlet: Drop ExecStartPre=rm %t/%N.cid\n  * Quadlet Kube: Set SyslogIdentifier if was not set\n  * Add a FreeBSD cross build to the cirrus alt build task\n  * Add completion for --init-ctr\n  * Fix handling of readonly containers when defined in kube.yaml\n  * Build cross-compilation fixes\n  * libpod: Track healthcheck API changes in healthcheck_unsupported.go\n  * quadlet: Use same default capability set as podman run\n  * quadlet: Drop --pull=never\n  * quadlet: Change default of ReadOnly to no\n  * quadlet: Change RunInit default to no\n  * quadlet: Change NoNewPrivileges default to false\n  * test: podman run with checkpoint image\n  * Enable 'podman run' for checkpoint images\n  * test: Add tests for checkpoint images\n  * CI setup: simplify environment passthrough code\n  * Init containers should not be restarted\n  * Update c/storage after https://github.com/containers/storage/pull/1436\n  * Set the latest release explicitly\n  * add friendly comment\n  * fix an overriding logic and load config problem\n  * Update the issue templates\n  * Update vendor of containers/(image, buildah)\n  * [CI:DOCS] Skip windows-smoke when not useful\n  * [CI:DOCS] Remove broken gate-container docs\n  * OWNERS: add Jason T. Greene\n  * hack/podmansnoop: print arguments\n  * Improve atomicity of VM state persistence on Windows\n  * [CI:BUILD] copr: enable podman-restart.service on rpm installation\n  * macos: pkg: Use -arm64 suffix instead of -aarch64\n  * linux: Add -linux suffix to podman-remote-static binaries\n  * linux: Build amd64 and arm64 podman-remote-static binaries\n  * container create: add inspect data to event\n  * Allow manual override of install location\n  * Run codespell on code\n  * Add missing parameters for checkpoint/restore endpoint\n  * Add support for startup healthchecks\n  * Add information on metrics to the `network create` docs\n  * Introduce podman machine os commands\n  * Document that ignoreRootFS depends on export/import\n  * Document ignoreVolumes in checkpoint/restore endpoint\n  * Remove leaveRunning from swagger restore endpoint\n  * libpod: Add checks to avoid nil pointer dereference if network setup fails\n  * Address golangci-lint issues\n  * Documenting Hyper-V QEMU acceleration settings\n  * Kube Play: fix the handling of the optional field of SecretVolumeSource\n  * Update Vendor of containers/(common, image, buildah)\n  * Fix swapped NetInput/-Output stats\n  * libpod: Use O_CLOEXEC for descriptors returned by (*Container).openDirectory\n  * chore: Fix MD for Troubleshooting Guide link in GitHub Issue Template\n  * test/tools: rebuild when files are changed\n  * ginkgo tests: apply ginkgolinter fixes\n  * ginkgo: restructure install work flow\n  * Fix manpage emphasis\n  * specgen: support CDI devices from containers.conf\n  * vendor: update containers/common\n  * pkg/trust: Take the default policy path from c/common/pkg/config\n  * Add validate-in-container target\n  * Adding encryption decryption feature\n  * container restart: clean up healthcheck state\n  * Add support for podman-remote manifest annotate\n  * Quadlet: Add support for .kube files\n  * Update vendor of containers/(buildah, common, storage, image)\n  * specgen: honor user namespace value\n  * [CI:DOCS] Migrate OSX Cross to M1\n  * quadlet: Rework uid/gid remapping\n  * GHA: Fix cirrus re-run workflow for other repos.\n  * ssh system test: skip until it becomes a test\n  * shell completion: fix hard coded network drivers\n  * libpod: Report network setup errors properly on FreeBSD\n  * E2E Tests: change the registry for the search test to avoid authentication\n  * pkginstaller: install podman-mac-helper by default\n  * Fix language. Mostly spelling a -> an\n  * podman machine: Propagate SSL_CERT_FILE and SSL_CERT_DIR to systemd environment.\n  * [CI:DOCS] Fix spelling and typos\n  * Modify man page of '--pids-limit' option to correct a default value.\n  * Update docs/source/markdown/podman-remote.1.md\n  * Update pkg/bindings/connection.go\n  * Add more documentation on UID/GID Mappings with --userns=keep-id\n  * support podman-remote to connect tcpURL with proxy\n  * Removing the RawInput from the API output\n  * fix port issues for CONTAINER_HOST\n  * CI: Package versions: run in the 'main' step\n  * build(deps): bump github.com/rootless-containers/rootlesskit\n  * pkg/domain: Make checkExecPreserveFDs platform-specific\n  * e2e tests: fix restart race\n  * Fix podman --noout to suppress all output\n  * remove pod if creation has failed\n  * pkg/rootless: Implement rootless.IsFdInherited on FreeBSD\n  * Fix more podman-logs flakes\n  * healthcheck system tests: try to fix flake\n  * libpod: treat ESRCH from /proc/PID/cgroup as ENOENT\n  * GHA: Configure workflows for reuse\n  * compat,build: handle docker's preconfigured cacheTo,cacheFrom\n  * docs: deprecate pasta network name\n  * utils: Enable cgroup utils for FreeBSD\n  * pkg/specgen: Disable kube play tests on FreeBSD\n  * libpod/lock: Fix build and tests for SHM locks on FreeBSD\n  * podman cp: fix copying with '.' suffix\n  * pkginstaller: bump Qemu to version 7.1.0\n  * specgen,wasm: switch to crun-wasm wherever applicable\n  * vendor: bump c/common to v0.50.2-0.20221111184705-791b83e1cdf1\n  * libpod: Make unit test for statToPercent Linux only\n  * Update vendor of containers/storage\n  * fix connection usage with containers.conf\n  * Add --quiet and --no-info flags to podman machine start\n  * Add hidden podman manifest inspect -v option\n  * Add podman volume create -d short option for driver\n  * Vendor in latest containers/(common,image,storage)\n  * Add podman system events alias to podman events\n  * Fix search_test to return correct version of alpine\n  * GHA: Fix undefined secret env. var.\n  * Release notes for 4.3.1\n  * GHA: Fix make_email-body script reference\n  * Add release keys to README\n  * GHA: Fix typo setting output parameter\n  * GHA: Fix typo.\n  * New tool, docs/version-check\n  * Formalize our compare-against-docker mechanism\n  * Add restart-sec for container service files\n  * test/tools: bump module to go 1.17\n  * contrib/cirrus/check_go_changes.sh: ignore test/tools/vendor\n  * build(deps): bump golang.org/x/tools from 0.1.12 to 0.2.0 in /test/tools\n  * libpod: Add FreeBSD support in packageVersion\n  * Allow podman manigest push --purge|-p as alias for --rm\n  * [CI:DOCS] Add performance tutorial\n  * [CI:DOCS] Fix build targets in build_osx.md.\n  * fix --format {{json .}} output to match docker\n  * remote: fix manifest add --annotation\n  * Skip test if `--events-backend` is necessary with podman-remote\n  * kube play: update the handling of PersistentVolumeClaim\n  * system tests: fix a system test in proxy environment\n  * Use single unqualified search registry on Windows\n  * test/system: Add, use tcp_port_probe() to check for listeners rather than binds\n  * test/system: Add tests for pasta(1) connectivity\n  * test/system: Move network-related helpers to helpers.network.bash\n  * test/system: Use procfs to find bound ports, with optional address and protocol\n  * test/system: Use port_is_free() from wait_for_port()\n  * libpod: Add pasta networking mode\n  * More log-flake work\n  * Fix test flakes caused by improper podman-logs\n  * fix incorrect systemd booted check\n  * Cirrus: Add tests for GHA scripts\n  * GHA: Update scripts to pass shellcheck\n  * Cirrus: Shellcheck github-action scripts\n  * Cirrus: shellcheck support for github-action scripts\n  * GHA: Fix cirrus-cron scripts\n  * Makefile: don't install to tmpfiles.d on FreeBSD\n  * Make sure we can build and read each line of docker py's api client\n  * Docker compat build api - make sure only one line appears per flush\n  * Run codespell on code\n  * Update vendor of containers/(image, storage, common)\n  * Allow namespace path network option for pods.\n  * Cirrus: Never skip running Windows Cross task\n  * GHA: Auto. re-run failed cirrus-cron builds once\n  * GHA: Migrate inline script to file\n  * GHA: Simplify script reference\n  * test/e2e: do not use apk in builds\n  * remove container/pod id file along with container/pod\n  * Cirrus: Synchronize windows image\n  * Add --insecure,--tls-verify,--verbose flags to podman manifest inspect\n  * runtime: add check for valid pod systemd cgroup\n  * CI: set and verify DESIRED_NETWORK (netavark, cni)\n  * [CI:DOCS] troubleshooting: document keep-id options\n  * Man pages: refactor common options: --security-opt\n  * Cirrus: Guarantee CNI testing w/o nv/av present\n  * Cirrus: temp. disable all Ubuntu testing\n  * Cirrus: Update to F37beta\n  * buildah bud tests: better handling of remote\n  * quadlet: Warn in generator if using short names\n  * Add Windows Smoke Testing\n  * Add podman kube apply command\n  * docs: offer advice on installing test dependencies\n  * Fix documentation on read-only-tmpfs\n  * version bump to 4.4.0-dev\n  * deps: bump go-criu to v6\n  * Makefile: Add cross build targets for freebsd\n  * pkg/machine: Make this build on FreeBSD/arm64\n  * pkg/rctl: Remove unused cgo dependency\n  * man pages: assorted underscore fixes\n  * Upgrade GitHub actions packages from v2 to v3\n  * vendor github.com/godbus/dbus/v5@4b691ce\n  * [CI:DOCS] fix --tmpdir typos\n  * Do not report that /usr/share/containers/storage.conf has been edited.\n  * Eval symlinks on XDG_RUNTIME_DIR\n  * hack/podmansnoop\n  * rootless: support keep-id with one mapping\n  * rootless: add argument to GetConfiguredMappings\n  * Update vendor containers/(common,storage,buildah,image)\n  * Fix deadlock between 'podman ps' and 'container inspect' commands\n  * Add information about where the libpod/boltdb database lives\n  * Consolidate the dependencies for the IsTerminal() API\n  * Ensure that StartAndAttach locks while sending signals\n  * ginkgo testing: fix podman usernamespace join\n  * Test runners: nuke podman from $PATH before tests\n  * volumes: Fix idmap not working for volumes\n  * FIXME: Temporary workaround for ubi8 CI breakage\n  * System tests: teardown: clean up volumes\n  * update api versions on docs.podman.io\n  * system tests: runlabel: use podman-under-test\n  * system tests: podman network create: use random port\n  * sig-proxy test: bump timeout\n  * play kube: Allow the user to import the contents of a tar file into a volume\n  * Clarify the docs on DropCapability\n  * quadlet tests: Disable kmsg logging while testing\n  * quadlet: Support multiple Network=\n  * quadlet: Add support for Network=...\n  * Fix manpage for podman run --network option\n  * quadlet: Add support for AddDevice=\n  * quadlet: Add support for setting seccomp profile\n  * quadlet: Allow multiple elements on each Add/DropCaps line\n  * quadlet: Embed the correct binary name in the generated comment\n  * quadlet: Drop the SocketActivated key\n  * quadlet: Switch log-driver to passthrough\n  * quadlet: Change ReadOnly to default to enabled\n  * quadlet tests: Run the tests even for (exected) failed tests\n  * quadlet tests: Fix handling of stderr checks\n  * Remove unused script file\n  * notifyproxy: fix container watcher\n  * container/pod id file: truncate instead of throwing an error\n  * quadlet: Use the new podman create volume --ignore\n  * Add podman volume create --ignore\n  * logcollector: include aardvark-dns\n  * build(deps): bump github.com/stretchr/testify from 1.8.0 to 1.8.1\n  * build(deps): bump github.com/BurntSushi/toml from 1.2.0 to 1.2.1\n  * docs: generate systemd: point to kube template\n  * docs: kube play: mention restart policy\n  * Fixes: 15858 (podman system reset --force destroy machine)\n  * fix search flake\n  * use cached containers.conf\n  * adding regex support to the ancestor ps filter function\n  * Fix `system df` issues with `-f` and `-v`\n  * markdown-preprocess: cross-reference where opts are used\n  * Default qemu flags for Windows amd64\n  * build(deps): bump golang.org/x/text from 0.3.8 to 0.4.0\n  * Update main to reflect v4.3.0 release\n  * build(deps): bump github.com/docker/docker\n  * move quadlet packages into pkg/systemd\n  * system df: fix image-size calculations\n  * Add man page for quadlet\n  * Fix small typo\n  * testimage: add iproute2 & socat, for pasta networking\n  * Set up minikube for k8s testing\n  * Makefile: don't install systemd generator binaries on FreeBSD\n  * [CI:BUILD] copr: podman rpm should depend on containers-common-extra\n  * Podman image: Set default_sysctls to empty for rootless containers\n  * Don't use  github.com/docker/distribution\n  * libpod: Add support for 'podman top' on FreeBSD\n  * libpod: Factor out jail name construction from stats_freebsd.go\n  * pkg/util: Add pid information descriptors for FreeBSD\n  * Initial quadlet version integrated in golang\n  * bump golangci-lint to v1.49.0\n  * Update vendor containers/(common,image,storage)\n  * Allow volume mount dups, iff source and dest dirs\n  * rootless: fix return value handling\n  * Change to correct break statements\n  * vendor containers/psgo@v1.8.0\n  * Clarify that MacOSX docs are client specific\n  * libpod: Factor out the call to PidFdOpen from (*Container).WaitForExit\n  * Add swagger install + allow version updates in CI\n  * Cirrus: Fix windows clone race\n  * build(deps): bump github.com/docker/docker\n  * kill: wait for the container\n  * generate systemd: set --stop-timeout for stopping containers\n  * hack/tree_status.sh: print diff at the end\n  * Fix markdown header typo\n  * markdown-preprocess: add generic include mechanism\n  * markdown-preprocess: almost complete OO rewrite\n  * Update tests for changed error messages\n  * Update c/image after https://github.com/containers/image/pull/1299\n  * Man pages: refactor common options (misc)\n  * Man pages: Refactor common options: --detach-keys\n  * vendor containers/storage@main\n  * Man pages: refactor common options: --attach\n  * build(deps): bump github.com/fsnotify/fsnotify from 1.5.4 to 1.6.0\n  * KillContainer: improve error message\n  * docs: add missing options\n  * Man pages: refactor common options: --annotation (manifest)\n  * build(deps): bump github.com/spf13/cobra from 1.5.0 to 1.6.0\n  * system tests: health-on-failure: fix broken logic\n  * build(deps): bump golang.org/x/text from 0.3.7 to 0.3.8\n  * build(deps): bump github.com/onsi/gomega from 1.20.2 to 1.22.1\n  * ContainerEngine.SetupRootless(): Avoid calling container.Config()\n  * Container filters: Avoid use of ctr.Config()\n  * Avoid unnecessary calls to Container.Spec()\n  * Add and use Container.LinuxResource() helper\n  * play kube: notifyproxy: listen before starting the pod\n  * play kube: add support for configmap binaryData\n  * Add and use libpod/Container.Terminal() helper\n  * Revert 'Add checkpoint image tests'\n  * Revert 'cmd/podman: add support for checkpoint images'\n  * healthcheck: fix --on-failure=stop\n  * Man pages: Add mention of behavior due to XDG_CONFIG_HOME\n  * build(deps): bump github.com/containers/ocicrypt from 1.1.5 to 1.1.6\n  * Avoid unnecessary timeout of 250msec when waiting on container shutdown\n  * health checks: make on-failure action retry aware\n  * libpod: Remove 100msec delay during shutdown\n  * libpod: Add support for 'podman pod' on FreeBSD\n  * libpod: Factor out cgroup validation from (*Runtime).NewPod\n  * libpod: Move runtime_pod_linux.go to runtime_pod_common.go\n  * specgen/generate: Avoid a nil dereference in MakePod\n  * libpod: Factor out cgroups handling from (*Pod).refresh\n  * Adds a link to OSX docs in CONTRIBUTING.md\n  * Man pages: refactor common options: --os-version\n  * Create full path to a directory when DirectoryOrCreate is used with play kube\n  * Return error in podman system service if URI scheme is not unix/tcp\n  * Man pages: refactor common options: --time\n  * man pages: document some --format options: images\n  * Clean up when stopping pods\n  * Update vendor of containers/buildah v1.28.0\n  * Proof of concept: nightly dependency treadmill\n\n- Make the priority for picking the storage driver configurable (bsc#1197093)\n","title":"Description of the patch"},{"category":"details","text":"SUSE-2023-1814,SUSE-SLE-Micro-5.3-2023-1814,SUSE-SLE-Micro-5.4-2023-1814,SUSE-SLE-Module-Containers-15-SP4-2023-1814,openSUSE-Leap-Micro-5.3-2023-1814,openSUSE-SLE-15.4-2023-1814","title":"Patchnames"},{"category":"legal_disclaimer","text":"CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).","title":"Terms of use"}],"publisher":{"category":"vendor","contact_details":"https://www.suse.com/support/security/contact/","name":"SUSE Product Security Team","namespace":"https://www.suse.com/"},"references":[{"category":"external","summary":"SUSE ratings","url":"https://www.suse.com/support/security/rating/"},{"category":"self","summary":"URL of this CSAF notice","url":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_1814-1.json"},{"category":"self","summary":"URL for SUSE-SU-2023:1814-1","url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231814-1/"},{"category":"self","summary":"E-Mail link for SUSE-SU-2023:1814-1","url":"https://lists.suse.com/pipermail/sle-security-updates/2023-May/014735.html"},{"category":"self","summary":"SUSE Bug 1197093","url":"https://bugzilla.suse.com/1197093"},{"category":"self","summary":"SUSE Bug 1208364","url":"https://bugzilla.suse.com/1208364"},{"category":"self","summary":"SUSE Bug 1208510","url":"https://bugzilla.suse.com/1208510"},{"category":"self","summary":"SUSE Bug 1209495","url":"https://bugzilla.suse.com/1209495"},{"category":"self","summary":"SUSE CVE CVE-2023-0778 page","url":"https://www.suse.com/security/cve/CVE-2023-0778/"}],"title":"Security update for podman","tracking":{"current_release_date":"2023-04-11T12:40:40Z","generator":{"date":"2023-04-11T12:40:40Z","engine":{"name":"cve-database.git:bin/generate-csaf.pl","version":"1"}},"id":"SUSE-SU-2023:1814-1","initial_release_date":"2023-04-11T12:40:40Z","revision_history":[{"date":"2023-04-11T12:40:40Z","number":"1","summary":"Current version"}],"status":"final","version":"1"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"podman-4.4.4-150400.4.16.1.aarch64","product":{"name":"podman-4.4.4-150400.4.16.1.aarch64","product_id":"podman-4.4.4-150400.4.16.1.aarch64"}},{"category":"product_version","name":"podman-remote-4.4.4-150400.4.16.1.aarch64","product":{"name":"podman-remote-4.4.4-150400.4.16.1.aarch64","product_id":"podman-remote-4.4.4-150400.4.16.1.aarch64"}}],"category":"architecture","name":"aarch64"},{"branches":[{"category":"product_version","name":"podman-4.4.4-150400.4.16.1.i586","product":{"name":"podman-4.4.4-150400.4.16.1.i586","product_id":"podman-4.4.4-150400.4.16.1.i586"}},{"category":"product_version","name":"podman-remote-4.4.4-150400.4.16.1.i586","product":{"name":"podman-remote-4.4.4-150400.4.16.1.i586","product_id":"podman-remote-4.4.4-150400.4.16.1.i586"}}],"category":"architecture","name":"i586"},{"branches":[{"category":"product_version","name":"podman-cni-config-4.4.4-150400.4.16.1.noarch","product":{"name":"podman-cni-config-4.4.4-150400.4.16.1.noarch","product_id":"podman-cni-config-4.4.4-150400.4.16.1.noarch"}},{"category":"product_version","name":"podman-docker-4.4.4-150400.4.16.1.noarch","product":{"name":"podman-docker-4.4.4-150400.4.16.1.noarch","product_id":"podman-docker-4.4.4-150400.4.16.1.noarch"}}],"category":"architecture","name":"noarch"},{"branches":[{"category":"product_version","name":"podman-4.4.4-150400.4.16.1.ppc64le","product":{"name":"podman-4.4.4-150400.4.16.1.ppc64le","product_id":"podman-4.4.4-150400.4.16.1.ppc64le"}},{"category":"product_version","name":"podman-remote-4.4.4-150400.4.16.1.ppc64le","product":{"name":"podman-remote-4.4.4-150400.4.16.1.ppc64le","product_id":"podman-remote-4.4.4-150400.4.16.1.ppc64le"}}],"category":"architecture","name":"ppc64le"},{"branches":[{"category":"product_version","name":"podman-4.4.4-150400.4.16.1.s390x","product":{"name":"podman-4.4.4-150400.4.16.1.s390x","product_id":"podman-4.4.4-150400.4.16.1.s390x"}},{"category":"product_version","name":"podman-remote-4.4.4-150400.4.16.1.s390x","product":{"name":"podman-remote-4.4.4-150400.4.16.1.s390x","product_id":"podman-remote-4.4.4-150400.4.16.1.s390x"}}],"category":"architecture","name":"s390x"},{"branches":[{"category":"product_version","name":"podman-4.4.4-150400.4.16.1.x86_64","product":{"name":"podman-4.4.4-150400.4.16.1.x86_64","product_id":"podman-4.4.4-150400.4.16.1.x86_64"}},{"category":"product_version","name":"podman-remote-4.4.4-150400.4.16.1.x86_64","product":{"name":"podman-remote-4.4.4-150400.4.16.1.x86_64","product_id":"podman-remote-4.4.4-150400.4.16.1.x86_64"}}],"category":"architecture","name":"x86_64"},{"branches":[{"category":"product_name","name":"SUSE Linux Enterprise Micro 5.3","product":{"name":"SUSE Linux Enterprise Micro 5.3","product_id":"SUSE Linux Enterprise Micro 5.3","product_identification_helper":{"cpe":"cpe:/o:suse:sle-micro:5.3"}}},{"category":"product_name","name":"SUSE Linux Enterprise Micro 5.4","product":{"name":"SUSE Linux Enterprise Micro 5.4","product_id":"SUSE Linux Enterprise Micro 5.4","product_identification_helper":{"cpe":"cpe:/o:suse:sle-micro:5.4"}}},{"category":"product_name","name":"SUSE Linux Enterprise Module for Containers 15 SP4","product":{"name":"SUSE Linux Enterprise Module for Containers 15 SP4","product_id":"SUSE Linux Enterprise Module for Containers 15 SP4","product_identification_helper":{"cpe":"cpe:/o:suse:sle-module-containers:15:sp4"}}},{"category":"product_name","name":"openSUSE Leap Micro 5.3","product":{"name":"openSUSE Leap Micro 5.3","product_id":"openSUSE Leap Micro 5.3","product_identification_helper":{"cpe":"cpe:/o:opensuse:leap-micro:5.3"}}},{"category":"product_name","name":"openSUSE Leap 15.4","product":{"name":"openSUSE Leap 15.4","product_id":"openSUSE Leap 15.4","product_identification_helper":{"cpe":"cpe:/o:opensuse:leap:15.4"}}}],"category":"product_family","name":"SUSE Linux Enterprise"}],"category":"vendor","name":"SUSE"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3","product_id":"SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64"},"product_reference":"podman-4.4.4-150400.4.16.1.aarch64","relates_to_product_reference":"SUSE Linux Enterprise Micro 5.3"},{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.s390x as component of SUSE Linux Enterprise Micro 5.3","product_id":"SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.s390x"},"product_reference":"podman-4.4.4-150400.4.16.1.s390x","relates_to_product_reference":"SUSE Linux Enterprise Micro 5.3"},{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3","product_id":"SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64"},"product_reference":"podman-4.4.4-150400.4.16.1.x86_64","relates_to_product_reference":"SUSE Linux Enterprise Micro 5.3"},{"category":"default_component_of","full_product_name":{"name":"podman-cni-config-4.4.4-150400.4.16.1.noarch as component of SUSE Linux Enterprise Micro 5.3","product_id":"SUSE Linux Enterprise Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch"},"product_reference":"podman-cni-config-4.4.4-150400.4.16.1.noarch","relates_to_product_reference":"SUSE Linux Enterprise Micro 5.3"},{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.aarch64 as component of SUSE Linux Enterprise Micro 5.4","product_id":"SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.aarch64"},"product_reference":"podman-4.4.4-150400.4.16.1.aarch64","relates_to_product_reference":"SUSE Linux Enterprise Micro 5.4"},{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.s390x as component of SUSE Linux Enterprise Micro 5.4","product_id":"SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.s390x"},"product_reference":"podman-4.4.4-150400.4.16.1.s390x","relates_to_product_reference":"SUSE Linux Enterprise Micro 5.4"},{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.x86_64 as component of SUSE Linux Enterprise Micro 5.4","product_id":"SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.x86_64"},"product_reference":"podman-4.4.4-150400.4.16.1.x86_64","relates_to_product_reference":"SUSE Linux Enterprise Micro 5.4"},{"category":"default_component_of","full_product_name":{"name":"podman-cni-config-4.4.4-150400.4.16.1.noarch as component of SUSE Linux Enterprise Micro 5.4","product_id":"SUSE Linux Enterprise Micro 5.4:podman-cni-config-4.4.4-150400.4.16.1.noarch"},"product_reference":"podman-cni-config-4.4.4-150400.4.16.1.noarch","relates_to_product_reference":"SUSE Linux Enterprise Micro 5.4"},{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.aarch64 as component of SUSE Linux Enterprise Module for Containers 15 SP4","product_id":"SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.aarch64"},"product_reference":"podman-4.4.4-150400.4.16.1.aarch64","relates_to_product_reference":"SUSE Linux Enterprise Module for Containers 15 SP4"},{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.ppc64le as component of SUSE Linux Enterprise Module for Containers 15 SP4","product_id":"SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.ppc64le"},"product_reference":"podman-4.4.4-150400.4.16.1.ppc64le","relates_to_product_reference":"SUSE Linux Enterprise Module for Containers 15 SP4"},{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.s390x as component of SUSE Linux Enterprise Module for Containers 15 SP4","product_id":"SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.s390x"},"product_reference":"podman-4.4.4-150400.4.16.1.s390x","relates_to_product_reference":"SUSE Linux Enterprise Module for Containers 15 SP4"},{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.x86_64 as component of SUSE Linux Enterprise Module for Containers 15 SP4","product_id":"SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.x86_64"},"product_reference":"podman-4.4.4-150400.4.16.1.x86_64","relates_to_product_reference":"SUSE Linux Enterprise Module for Containers 15 SP4"},{"category":"default_component_of","full_product_name":{"name":"podman-cni-config-4.4.4-150400.4.16.1.noarch as component of SUSE Linux Enterprise Module for Containers 15 SP4","product_id":"SUSE Linux Enterprise Module for Containers 15 SP4:podman-cni-config-4.4.4-150400.4.16.1.noarch"},"product_reference":"podman-cni-config-4.4.4-150400.4.16.1.noarch","relates_to_product_reference":"SUSE Linux Enterprise Module for Containers 15 SP4"},{"category":"default_component_of","full_product_name":{"name":"podman-docker-4.4.4-150400.4.16.1.noarch as component of SUSE Linux Enterprise Module for Containers 15 SP4","product_id":"SUSE Linux Enterprise Module for Containers 15 SP4:podman-docker-4.4.4-150400.4.16.1.noarch"},"product_reference":"podman-docker-4.4.4-150400.4.16.1.noarch","relates_to_product_reference":"SUSE Linux Enterprise Module for Containers 15 SP4"},{"category":"default_component_of","full_product_name":{"name":"podman-remote-4.4.4-150400.4.16.1.aarch64 as component of SUSE Linux Enterprise Module for Containers 15 SP4","product_id":"SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.aarch64"},"product_reference":"podman-remote-4.4.4-150400.4.16.1.aarch64","relates_to_product_reference":"SUSE Linux Enterprise Module for Containers 15 SP4"},{"category":"default_component_of","full_product_name":{"name":"podman-remote-4.4.4-150400.4.16.1.ppc64le as component of SUSE Linux Enterprise Module for Containers 15 SP4","product_id":"SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.ppc64le"},"product_reference":"podman-remote-4.4.4-150400.4.16.1.ppc64le","relates_to_product_reference":"SUSE Linux Enterprise Module for Containers 15 SP4"},{"category":"default_component_of","full_product_name":{"name":"podman-remote-4.4.4-150400.4.16.1.s390x as component of SUSE Linux Enterprise Module for Containers 15 SP4","product_id":"SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.s390x"},"product_reference":"podman-remote-4.4.4-150400.4.16.1.s390x","relates_to_product_reference":"SUSE Linux Enterprise Module for Containers 15 SP4"},{"category":"default_component_of","full_product_name":{"name":"podman-remote-4.4.4-150400.4.16.1.x86_64 as component of SUSE Linux Enterprise Module for Containers 15 SP4","product_id":"SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.x86_64"},"product_reference":"podman-remote-4.4.4-150400.4.16.1.x86_64","relates_to_product_reference":"SUSE Linux Enterprise Module for Containers 15 SP4"},{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.aarch64 as component of openSUSE Leap Micro 5.3","product_id":"openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64"},"product_reference":"podman-4.4.4-150400.4.16.1.aarch64","relates_to_product_reference":"openSUSE Leap Micro 5.3"},{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.x86_64 as component of openSUSE Leap Micro 5.3","product_id":"openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64"},"product_reference":"podman-4.4.4-150400.4.16.1.x86_64","relates_to_product_reference":"openSUSE Leap Micro 5.3"},{"category":"default_component_of","full_product_name":{"name":"podman-cni-config-4.4.4-150400.4.16.1.noarch as component of openSUSE Leap Micro 5.3","product_id":"openSUSE Leap Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch"},"product_reference":"podman-cni-config-4.4.4-150400.4.16.1.noarch","relates_to_product_reference":"openSUSE Leap Micro 5.3"},{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.aarch64 as component of openSUSE Leap 15.4","product_id":"openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.aarch64"},"product_reference":"podman-4.4.4-150400.4.16.1.aarch64","relates_to_product_reference":"openSUSE Leap 15.4"},{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.ppc64le as component of openSUSE Leap 15.4","product_id":"openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.ppc64le"},"product_reference":"podman-4.4.4-150400.4.16.1.ppc64le","relates_to_product_reference":"openSUSE Leap 15.4"},{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.s390x as component of openSUSE Leap 15.4","product_id":"openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.s390x"},"product_reference":"podman-4.4.4-150400.4.16.1.s390x","relates_to_product_reference":"openSUSE Leap 15.4"},{"category":"default_component_of","full_product_name":{"name":"podman-4.4.4-150400.4.16.1.x86_64 as component of openSUSE Leap 15.4","product_id":"openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.x86_64"},"product_reference":"podman-4.4.4-150400.4.16.1.x86_64","relates_to_product_reference":"openSUSE Leap 15.4"},{"category":"default_component_of","full_product_name":{"name":"podman-cni-config-4.4.4-150400.4.16.1.noarch as component of openSUSE Leap 15.4","product_id":"openSUSE Leap 15.4:podman-cni-config-4.4.4-150400.4.16.1.noarch"},"product_reference":"podman-cni-config-4.4.4-150400.4.16.1.noarch","relates_to_product_reference":"openSUSE Leap 15.4"},{"category":"default_component_of","full_product_name":{"name":"podman-docker-4.4.4-150400.4.16.1.noarch as component of openSUSE Leap 15.4","product_id":"openSUSE Leap 15.4:podman-docker-4.4.4-150400.4.16.1.noarch"},"product_reference":"podman-docker-4.4.4-150400.4.16.1.noarch","relates_to_product_reference":"openSUSE Leap 15.4"},{"category":"default_component_of","full_product_name":{"name":"podman-remote-4.4.4-150400.4.16.1.aarch64 as component of openSUSE Leap 15.4","product_id":"openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.aarch64"},"product_reference":"podman-remote-4.4.4-150400.4.16.1.aarch64","relates_to_product_reference":"openSUSE Leap 15.4"},{"category":"default_component_of","full_product_name":{"name":"podman-remote-4.4.4-150400.4.16.1.ppc64le as component of openSUSE Leap 15.4","product_id":"openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.ppc64le"},"product_reference":"podman-remote-4.4.4-150400.4.16.1.ppc64le","relates_to_product_reference":"openSUSE Leap 15.4"},{"category":"default_component_of","full_product_name":{"name":"podman-remote-4.4.4-150400.4.16.1.s390x as component of openSUSE Leap 15.4","product_id":"openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.s390x"},"product_reference":"podman-remote-4.4.4-150400.4.16.1.s390x","relates_to_product_reference":"openSUSE Leap 15.4"},{"category":"default_component_of","full_product_name":{"name":"podman-remote-4.4.4-150400.4.16.1.x86_64 as component of openSUSE Leap 15.4","product_id":"openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.x86_64"},"product_reference":"podman-remote-4.4.4-150400.4.16.1.x86_64","relates_to_product_reference":"openSUSE Leap 15.4"}]},"vulnerabilities":[{"cve":"CVE-2023-0778","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2023-0778"}],"notes":[{"category":"general","text":"A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.","title":"CVE description"}],"product_status":{"recommended":["SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64","SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.s390x","SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64","SUSE Linux Enterprise Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch","SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.aarch64","SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.s390x","SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.x86_64","SUSE Linux Enterprise Micro 5.4:podman-cni-config-4.4.4-150400.4.16.1.noarch","SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.aarch64","SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.ppc64le","SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.s390x","SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.x86_64","SUSE Linux Enterprise Module for Containers 15 SP4:podman-cni-config-4.4.4-150400.4.16.1.noarch","SUSE Linux Enterprise Module for Containers 15 SP4:podman-docker-4.4.4-150400.4.16.1.noarch","SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.aarch64","SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.ppc64le","SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.s390x","SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.x86_64","openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.aarch64","openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.ppc64le","openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.s390x","openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.x86_64","openSUSE Leap 15.4:podman-cni-config-4.4.4-150400.4.16.1.noarch","openSUSE Leap 15.4:podman-docker-4.4.4-150400.4.16.1.noarch","openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.aarch64","openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.ppc64le","openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.s390x","openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.x86_64","openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64","openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64","openSUSE Leap Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch"]},"references":[{"category":"external","summary":"CVE-2023-0778","url":"https://www.suse.com/security/cve/CVE-2023-0778"},{"category":"external","summary":"SUSE Bug 1208364 for CVE-2023-0778","url":"https://bugzilla.suse.com/1208364"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64","SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.s390x","SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64","SUSE Linux Enterprise Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch","SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.aarch64","SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.s390x","SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.x86_64","SUSE Linux Enterprise Micro 5.4:podman-cni-config-4.4.4-150400.4.16.1.noarch","SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.aarch64","SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.ppc64le","SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.s390x","SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.x86_64","SUSE Linux Enterprise Module for Containers 15 SP4:podman-cni-config-4.4.4-150400.4.16.1.noarch","SUSE Linux Enterprise Module for Containers 15 SP4:podman-docker-4.4.4-150400.4.16.1.noarch","SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.aarch64","SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.ppc64le","SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.s390x","SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.x86_64","openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.aarch64","openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.ppc64le","openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.s390x","openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.x86_64","openSUSE Leap 15.4:podman-cni-config-4.4.4-150400.4.16.1.noarch","openSUSE Leap 15.4:podman-docker-4.4.4-150400.4.16.1.noarch","openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.aarch64","openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.ppc64le","openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.s390x","openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.x86_64","openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64","openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64","openSUSE Leap Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch"]}],"scores":[{"cvss_v3":{"baseScore":6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"products":["SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64","SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.s390x","SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64","SUSE Linux Enterprise Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch","SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.aarch64","SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.s390x","SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.x86_64","SUSE Linux Enterprise Micro 5.4:podman-cni-config-4.4.4-150400.4.16.1.noarch","SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.aarch64","SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.ppc64le","SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.s390x","SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.x86_64","SUSE Linux Enterprise Module for Containers 15 SP4:podman-cni-config-4.4.4-150400.4.16.1.noarch","SUSE Linux Enterprise Module for Containers 15 SP4:podman-docker-4.4.4-150400.4.16.1.noarch","SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.aarch64","SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.ppc64le","SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.s390x","SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.x86_64","openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.aarch64","openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.ppc64le","openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.s390x","openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.x86_64","openSUSE Leap 15.4:podman-cni-config-4.4.4-150400.4.16.1.noarch","openSUSE Leap 15.4:podman-docker-4.4.4-150400.4.16.1.noarch","openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.aarch64","openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.ppc64le","openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.s390x","openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.x86_64","openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64","openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64","openSUSE Leap Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch"]}],"threats":[{"category":"impact","date":"2023-04-11T12:40:40Z","details":"moderate"}],"title":"CVE-2023-0778"}]}