Alpine: multiple podman packages: security update to 5.8.8-r0

medium Tenable Cloud Security Plugin ID 448495

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command,
they can create files on the host machine with the privileges of the user running Podman. (CVE-2025-11395)

- A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout
header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary
file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
(CVE-2026-79699)

- A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a
crafted tar archive containing malicious symlinks can escape the target extraction directory and create
files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
(CVE-2026-79705)

Solution

Update the podman library and its related packages to version 5.8.8-r0 or later.

Plugin Details

Severity: Medium

ID: 448495

Version: Revision 1.1

Type: Local

Family: Alpine Linux Local Security Checks

Published: 9/30/2026

Updated: 9/30/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.61

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:L/Au:M/C:N/I:C/A:N

CVSS Score Source: CVE-2026-79705

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2025-11395

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/15/2026

Reference Information

CVE: CVE-2025-11395, CVE-2026-79699, CVE-2026-79705, CVE-2026-94603

Detections

Analytics