SB20250908113 - Fedora 41 update for buildah, containers-common, podman
Published: September 8, 2025
Security Bulletin ID
SB20250908113
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Link following (CVE-ID: CVE-2025-9566)
The vulnerability allows a malicious container to perform a denial of service (DoS) attack.
The vulnerability exists due to an insecure link following issue in podman kube play command. A malicious container can overwrite host files when the kube file contains a ConfigMap or Secret volume mount and the volume already contains a symlink to a host file.
Note, a malicious container can write to arbitrary files on the host BUT the attacker only controls the target path not the contents that will be written to the file.
Remediation
Install update from vendor's website.