VYPR
← All advisories
High severityNVD Advisory· Published Sep 13, 2022· Updated Jun 5, 2025

CVE-2022-2989

CVE-2022-2989

Description

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Podman incorrectly handles supplementary groups inside containers, allowing information disclosure or data modification by a local attacker with code execution.

Root

Cause

The Podman container engine had an incorrect handling of supplementary groups when setting access permissions inside a container [2]. This flaw could cause the container to apply group-based permissions that differ from the intended security policy, potentially granting unintended access to files or resources.

Exploitation

To exploit this vulnerability, an attacker must have direct access to the affected container and be able to execute arbitrary binary code within it [2]. No special network access or additional authentication is required beyond what is already available in the compromised container.

Impact

A successful exploit could lead to sensitive information disclosure or unauthorized data modification [2]. The attacker might read files that should be restricted based on group membership, or modify data that should be protected, effectively bypassing the intended access controls.

Mitigation

Red Hat has released updated packages for Podman (4.2.0-7) and related tools (e.g., buildah, aardvark-dns) through RHSA-2022:7822, RHSA-2022:8431, and RHSA-2022:8008 [1][3]. Users should update to the fixed versions to remediate this vulnerability.

References
  1. https://access.redhat.com/errata/RHSA-2022:7822
  2. https://access.redhat.com/errata/RHSA-2022:8431
  3. https://access.redhat.com/errata/RHSA-2022:8008

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/containers/podman/v4Go
< 4.2.04.2.0
github.com/containers/podman/v3Go
< 3.0.13.0.1

Affected products

52

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.