Vulnerability · Published Sep 1, 2022 · Assigned by redhat

CVE-2022-2738

High 7.5

In plain English

A high-severity use-after-free in podman. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)0.9%top 39.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-8945, which was previously fixed via RHSA-2020:2117. This issue could possibly be used to crash or cause potential code execution in Go applications that use the Go GPGME wrapper library, under certain conditions, during GPG signature verification.

Affected products (as reported)

Vendor	Product	Versions
n/a	podman	podman 1.6.4-32.el7_9

Weakness: CWE-416

References

https://bugzilla.redhat.com/show_bug.cgi?id=2116923 x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2022-2738 x_refsource_MISC