Alpine: multiple podman packages: security update to 5.8.8-r0

critical Tenable Cloud Security Plugin ID 448495

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command,
they can create files on the host machine with the privileges of the user running Podman. (CVE-2025-11395)

- A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout
header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary
file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
(CVE-2026-79699)

- A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a
crafted tar archive containing malicious symlinks can escape the target extraction directory and create
files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
(CVE-2026-79705)

- Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats
an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and
silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-
controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are
not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions
5.8.8 and 6.1.3. (CVE-2026-94603)

Solution

Update the podman library and its related packages to version 5.8.8-r0 or later.

Plugin Details

Severity: Critical

ID: 448495

Version: Revision 1.2

Type: Local

Family: Alpine Linux Local Security Checks

Published: 9/30/2026

Updated: 10/14/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.03

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-94603

CVSS v3

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/15/2026

Reference Information

CVE: CVE-2025-11395, CVE-2026-79699, CVE-2026-79705, CVE-2026-94603

Detections

Analytics