SB2025111146 - Red Hat Enterprise Linux 9 update for podman
Published: November 11, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Race condition (CVE-ID: CVE-2025-47907)
The vulnerability allows an attacker to tamper with the application.
The vulnerability exists due to a race condition when canceling a DB query. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system. A remote user can overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
2) Link following (CVE-ID: CVE-2025-9566)
The vulnerability allows a malicious container to perform a denial of service (DoS) attack.
The vulnerability exists due to an insecure link following issue in podman kube play command. A malicious container can overwrite host files when the kube file contains a ConfigMap or Secret volume mount and the volume already contains a symlink to a host file.
Note, a malicious container can write to arbitrary files on the host BUT the attacker only controls the target path not the contents that will be written to the file.
Remediation
Install update from vendor's website.