Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-2989

24
FAUCET Score

CVE-2022-2989 describes an incorrect handling of supplementary groups in the Podman container engine, potentially leading to sensitive information disclosure or data modification. This vulnerability affects various Podman and Red Hat Enterprise Linux/OpenShift Container Platform products. With a CVSS score of 7.1 (HIGH), it requires local access and the ability to execute binary code within an affected container to exploit. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
All Versions ImpactedCPE matchmatch criteria
cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:*
3.11CPE matchmatch criteria
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
4.0CPE matchmatch criteria
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
7.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
8.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.1HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
1.8
Impact Score
5.2
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.31%
Probability of exploitation in next 30 days
EPSS Percentile
22.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0031 is in the 59th percentile among its peer group of 16,985 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (23)

gopatch availablevia ghsa
Product: github.com/containers/podman/v4Fixed in: 4.2.0
gopatch availablevia ghsa
Product: github.com/containers/podman/v3Fixed in: 3.0.1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 4.1.1-10
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 4.1.1-10
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: buildah-1:1.27.0-2.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: podman-2:4.2.0-7.el9_1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: buildah-1:1.23.4-5.rhaos4.12.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: conmon-2:2.1.2-5.rhaos4.12.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: kernel-0:4.18.0-372.59.1.el8_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: kernel-rt-0:4.18.0-372.59.1.rt7.217.el8_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: openshift-0:4.12.0-202306121916.p0.g8c21020.assembly.stream.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: openshift4-aws-iso-0:4.12.0-202306090942.p0.gd2acdd5.assembly.stream.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: openshift-ansible-0:4.12.0-202306090942.p0.g74dc7b3.assembly.stream.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: openshift-clients-0:4.12.0-202306090942.p0.g3c01edd.assembly.stream.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: openshift-kuryr-0:4.12.0-202306140156.p0.g31dd228.assembly.stream.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: podman-3:4.2.0-7.rhaos4.12.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: runc-3:1.1.6-4.rhaos4.12.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: skopeo-2:1.9.4-3.rhaos4.12.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: containernetworking-plugins-0:1.0.1-7.rhaos4.12.el8
View patch
redhatpatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: container-tools:rhel8-8070020221026183352.489fc8e9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: container-tools:4.0-8080020230217080101.8108cfbc
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: podman

Vendor Advisories (4)

microsoft2023-May/CVE-2022-2989

CVE-2022-2989

May 9, 2023
goGHSA-4wjj-jwc9-2x96high

Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification

Sep 14, 2022
microsoft2022-Sep/CVE-2022-2989

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

Sep 13, 2022
redhatCVE-2022-2989Low

podman: possible information disclosure and modification

Aug 22, 2022

References

bugzilla.redhat.com / show_bug.cgi
ExploitIssue TrackingPatchThird Party Advisory
benthamsgaze.org / 2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation
ExploitThird Party Advisory