CVE-2022-27649

Name	CVE-2022-27649
Description	A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1020906

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libpod (PTS)	bullseye	3.0.1+dfsg1-3+deb11u5	fixed
	bookworm	4.3.1+ds1-8+deb12u1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libpod	source	bullseye	3.0.1+dfsg1-3+deb11u2
libpod	source	(unstable)	3.4.6+ds1-1			1020906

Notes

https://github.com/containers/podman/releases/tag/v4.0.3
https://github.com/containers/podman/commit/aafa80918a245edcbdaceb1191d749570f1872d0 (main)
https://github.com/containers/podman/commit/7b368768c2990b9781b2b6813e1c7f91c7e6cb13 (v4.0.3)