CVE-2022-2738

HIGH

Red Hat Enterprise Linux Server and Workstation - Use-After-Free in Podman GPGME Wrapper

Title source: llm

Description

The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-8945, which was previously fixed via RHSA-2020:2117. This issue could possibly be used to crash or cause potential code execution in Go applications that use the Go GPGME wrapper library, under certain conditions, during GPG signature verification.

References (2)

Core 2

Core References

Issue Tracking, Vendor Advisory x_refsource_misc

https://bugzilla.redhat.com/show_bug.cgi?id=2116923

Vendor Advisory x_refsource_misc

https://access.redhat.com/security/cve/CVE-2022-2738

Scores

CVSS v3 7.5

EPSS 0.0055

EPSS Percentile 68.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-416

Status published

Products (3)

podman_project/podman 1.6.4-32.el7_9

redhat/enterprise_linux_server 7.0

redhat/enterprise_linux_workstation 7.0

Published Sep 01, 2022

Tracked Since Feb 18, 2026