Podman: build context bind mount (podman)

CVE-2025-4953

HIGH 7.4

En bref

Source: NVD
EPSS: EPSS 0.64 % · centile 51 (2026-10-29)
État: PUBLISHED
Publiée: 2025-09-16 14:54 UTC
Mise à jour: 2026-10-14 17:27 UTC
Attribuée par: redhat
Statut NVD: Deferred

Rechercher sur…

Description

A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files accessible.

Faiblesses (CWE)

CWE-378 — Création d'un fichier temporaire aux permissions non sécurisées

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	redhat
CVSS 3.1	HIGH 7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	NVD · secalert@redhat.com (Secondary)

Avis

GHSA-m68q-4hqr-mc6f — Podman Creates Temporary File with Insecure Permissions
GO-2025-3961 — Podman Creates Temporary File with Insecure Permissions in github.com/containers/podman

Références européennes

ENISA EUVD · EUVD-2025-29612
GCVE · GCVE-0-2025-4953

Produits affectés

Produit	Versions
podman	affected 0 < *
Red Hat · Red Hat Enterprise Linux 8	unaffected 8100020250911075811.afee755d < *
Red Hat · Red Hat OpenShift Container Platform 4.12	unaffected 3:4.2.0-15.rhaos4.12.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.12	unaffected 412.86.202601061735-0 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 1:1.29.1-5.rhaos4.13.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 3:2.1.7-5.rhaos4.13.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 1:1.4.0-5.rhaos4.13.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:1.26.5-26.rhaos4.13.giteb3d487.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:1.26.0-7.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:2.2.24-5.rhaos4.13.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:2.15.0-10.rhaos4.13.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:4.13.0-202410181847.p0.g53fd427.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:4.13.0-202410181847.p0.gd2acdd5.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:4.13.0-202410181847.p0.g1397e80.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:4.13.0-202410181847.p0.gd192e90.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 0:4.13.0-202410181847.p0.g36754b7.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 3:4.4.1-15.rhaos4.13.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 4:1.1.14-2.rhaos4.13.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 2:1.11.3-4.rhaos4.13.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 1:1.29.5-1.rhaos4.13.el8 < *

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Podman: build context bind mount (podman)