Source: podman Version: 5.8.3+ds1-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for podman. CVE-2026-57231[0]: | Podman is a tool for managing OCI containers and pods. From 1.8.1 | until 5.8.4, a container image that contains a environment variable | with just a key and no value can trick podman into passing that | variable from the host into the container. This is made worse by the | fact that using an asterisk (*) will cause podman to pass all host | variables into the container. So essentially a malicious image can | exfiltrate all podman environment variables that are set in the | session from where the container is launched. This vulnerability is | fixed in 5.8.4 and 6.0.0. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-57231 https://www.cve.org/CVERecord?id=CVE-2026-57231 [1] https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68 [2] https://github.com/podman-container-tools/podman/commit/85832029d537c2c0df89e47d4a03d55ba099a848 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
