{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for podman",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for podman fixes the following issues:\n\nUpdate to version 4.4.4:\n\n  * libpod: always use direct mapping\n  * macos pkginstaller: do not fail when podman-mac-helper fails\n  * podman-mac-helper: install: do not error if already installed\n\n- podman.spec: Bump required version for libcontainers-common (bsc#1209495)\n\nUpdate to version 4.4.3:\n\n  * compat: /auth: parse server address correctly\n  * vendor github.com/containers/common@v0.51.1\n  * pkginstaller: bump Qemu to version 7.2.0\n  * podman machine: Adjust Chrony makestep config\n  * [v4.4] fix --health-on-failure=restart in transient unit\n  * podman logs passthrough driver support --cgroups=split\n  * journald logs: simplify entry parsing\n  * podman logs: read journald with passthrough\n  * journald: remove initializeJournal()\n  * netavark: only use aardvark ip as nameserver\n  * compat API: network create return 409 for duplicate\n  * fix \u0027podman logs --since --follow\u0027 flake\n  * system service --log-level=trace: support hijack\n  * podman-mac-helper: exit 1 on error\n  * bump golang.org/x/net to v0.8.0\n  * Fix package restore\n  * Quadlet - use the default runtime\n\nUpdate to version 4.4.2:\n\n  * Revert \u0027CI: Temporarily disable all AWS EC2-based tasks\u0027\n  * kube play: only enforce passthrough in Quadlet\n  * Emergency fix for man pages: check for broken includes\n  * CI: Temporarily disable all AWS EC2-based tasks\n  * quadlet system tests: add useful defaults, logging\n  * volume,container: chroot to source before exporting content\n  * install sigproxy before start/attach\n  * Update to c/image 5.24.1\n  * events + container inspect test: RHEL fixes\n\n- podman.spec: add `crun` requirement for quadlet\n- podman.spec: set PREFIX at build stage (bsc#1208510)\n\n- CVE-2023-0778: Fixed symlink exchange attack in podman export volume  (bsc#1208364)\n\nUpdate to version 4.4.1:\n\n  * kube play: do not teardown unconditionally on error\n  * Resolve symlink path for qemu directory if possible\n  * events: document journald identifiers\n  * Quadlet: exit 0 when there are no files to process\n  * Cleanup podman-systemd.unit file\n  * Install podman-systemd.unit  man page, make quadlet discoverable\n  * Add missing return after errors\n  * oci: bind mount /sys with --userns=(auto|pod:)\n  * docs: specify order preference for FROM\n  * Cirrus: Fix \u0026 remove GraphQL API tests\n  * test: adapt test to work on cgroupv1\n  * make hack/markdown-preprocess parallel-safe\n  * Fix default handling of pids-limit\n  * system tests: fix volume exec/noexec test\n\nUpdate to version 4.4.0:\n\n  * Emergency fix for RHEL8 gating tests\n  * Do not mount /dev/tty into rootless containers\n  * Fixes port collision issue on use of --publish-all\n  * Fix usage of absolute windows paths with --image-path\n  * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux\n  * podman-events: document verbose create events\n  * Making gvproxy.exe optional for building Windows installer\n  * Add gvproxy to Windows packages\n  * Match VT device paths to be blocked from mounting exactly\n  * Clean up more language for inclusiveness\n  * Set runAsNonRoot=true in gen kube\n  * quadlet: Add device support for .volume files\n  * fix: running check error when podman is default in wsl\n  * fix: don\u0027t output \u0027ago\u0027 when container is currently up and running\n  * journald: podman logs only show logs for current user\n  * journald: podman events only show events for current user\n  * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml)\n  * DB: make loading container states optional\n  * ps: do not sync container\n  * Allow --device-cgroup-rule to be passed in by docker API\n  * Create release notes for v4.4.0\n  * Cirrus: Update operating branch\n  * fix APIv2 python attach test flake\n  * ps: query health check in batch mode\n  * make example volume import, not import volume\n  * Correct output when inspecting containers created with --ipc\n  * Vendor containers/(storage, image, common, buildah)\n  * Get correct username in pod when using --userns=keep-id\n  * ps: get network data in batch mode\n  * build(deps): bump github.com/onsi/gomega from 1.25.0 to 1.26.0\n  * add hack/perf for comparing two container engines\n  * systems: retrofit dns options test to honor other search domains\n  * ps: do not create copy of container config\n  * libpod: set search domain independently of nameservers\n  * libpod,netavark: correctly populate /etc/resolv.conf with custom dns server\n  * podman: relay custom DNS servers to network stack\n  * (fix) mount_program is in storage.options.overlay\n  * Change example target to default in doc\n  * network create: do not allow `default` as name\n  * kube-play: add support for HostPID in podSpec\n  * build(deps): bump github.com/docker/docker\n  * Let\u0027s see if #14653 is fixed or not\n  * Add support for podman build --group-add\n  * vendor in latests containers/(storage, common, build, image)\n  * unskip network update test\n  * do not install swagger by default\n  * pasta: skip \u0027Local forwarder, IPv4\u0027 test\n  * add testbindings Makefile target\n  * update CI images to include pasta\n  * [CI:DOCS] Add CNI deprecation notices to documentation\n  * Cirrus: preserve podman-server logs\n  * waitPidStop: reduce sleep time to 10ms\n  * StopContainer: return if cleanup process changed state\n  * StopSignal: add a comment\n  * StopContainer: small refactor\n  * waitPidStop: simplify code\n  * e2e tests: reenable long-skipped build test\n  * Add openssh-clients to podmanimage\n  * Reworks Windows smoke test to tunnel through interactive session.\n  * fix bud-multiple-platform-with-base-as-default-arg flake\n  * Remove ReservedAnnotations from kube generate specification\n  * e2e: update test/README.md\n  * e2e: use isRootless() instead of rootless.IsRootless()\n  * Cleanup documentation on --userns=auto\n  * Vendor in latest c/common\n  * sig-proxy system test: bump timeout\n  * build(deps): bump github.com/containernetworking/plugins\n  * rootless: rename auth-scripts to preexec-hooks\n  * Docs: version-check updates\n  * commit: use libimage code to parse changes\n  * [CI:DOCS] Remove experimental mac tutorial\n  * man: Document the interaction between --systemd and --privileged\n  * Make rootless privileged containers share the same tty devices as rootfull ones\n  * container kill: handle stopped/exited container\n  * Vendor in latest containers/(image,ocicrypt)\n  * add a comment to container removal\n  * Vendor in latest containers/storage\n  * Cirrus: Run machine tests on PR merge\n  * fix flake in kube system test\n  * kube play: complete container spec\n  * E2E Tests: Use inspect instead of actual data to avoid UDP flake\n  * Use containers/storage/pkg/regexp in place of regexp\n  * Vendor in latest containers/storage\n  * Cirrus: Support using updated/latest NV/AV in PRs\n  * Limit replica count to 1 when deploying from kubernetes YAML\n  * Set StoppedByUser earlier in the process of stopping\n  * podman-play system test: refactor\n  * network: add support for podman network update and --network-dns-server\n  * service container: less verbose error logs\n  * Quadlet Kube - add support for PublishPort key\n  * e2e: fix systemd_activate_test\n  * Compile regex on demand not in init\n  * [docker compat] Don\u0027t overwrite the NetworkMode if containers.conf overrides netns.\n  * E2E Test: Play Kube set deadline to connection to avoid hangs\n  * Only prevent VTs to be mounted inside privileged systemd containers\n  * e2e: fix play_kube_test\n  * Updated error message for supported VolumeSource types\n  * Introduce pkg retry logic in win installer task\n  * logformatter: include base SHA, with history link\n  * Network tests: ping redhat.com, not podman.io\n  * cobra: move engine shutdown to Execute\n  * Updated options for QEMU on Windows hosts\n  * Update Mac installer to use gvproxy v0.5.0\n  * podman: podman rm -f doesn\u0027t leave processes\n  * oci: check for valid PID before kill(pid, 0)\n  * linux: add /sys/fs/cgroup if /sys is a bind mount\n  * Quadlet: Add support for ConfigMap key in Kube section\n  * remove service container _after_ pods\n  * Kube Play - allow setting and overriding published host ports\n  * oci: terminate all container processes on cleanup\n  * Update win-sshproxy to 0.5.0 gvisor tag\n  * Vendor in latest containers/common\n  * Fix a potential defer logic error around locking\n  * logformatter: nicer formatting for bats failures\n  * logformatter: refactor verbose line-print\n  * e2e tests: stop using UBI images\n  * k8s-file: podman logs --until --follow exit after time\n  * journald: podman logs --until --follow exit after time\n  * journald: seek to time when --since is used\n  * podman logs: journald fix --since and --follow\n  * Preprocess files in UTF-8 mode\n  * Vendor in latest containers/(common, image, storage)\n  * Switch to C based msi hooks for win installer\n  * hack/bats: improve usage message\n  * hack/bats: add --remote option\n  * hack/bats: fix root/rootless logic\n  * Describe copy volume options\n  * Support sig-proxy for podman-remote attach and start\n  * libpod: fix race condition rm\u0027ing stopping containers\n  * e2e: fix run_volume_test\n  * Add support for Windows ARM64\n  * Add shared --compress to man pages\n  * Add container error message to ContainerState\n  * Man page checker: require canonical name in SEE ALSO\n  * system df: improve json output code\n  * kube play: fix the error logic with --quiet\n  * System tests: quadlet network test\n  * Fix: List container with volume filter\n  * adding -dryrun flag\n  * Quadlet Container: Add support for EnvironmentFile and EnvironmentHost\n  * Kube Play: use passthrough as the default log-driver if service-container is set\n  * System tests: add missing cleanup\n  * System tests: fix unquoted question marks\n  * Build and use a newer systemd image\n  * Quadlet Network - Fix the name of the required network service\n  * System Test Quadlet - Volume dependency test did not test the dependency\n  * fix `podman system connection - tcp` flake\n  * vendor: bump c/storage to a747b27\n  * Fix instructions about setting storage driver on command-line\n  * Test README - point users to hack/bats\n  * System test: quadlet kube basic test\n  * Fixed `podman update --pids-limit`\n  * podman-remote,bindings: trim context path correctly when its emptydir\n  * Quadlet Doc: Add section for .kube files\n  * e2e: fix containers_conf_test\n  * Allow \u0027/\u0027 to prefix container names to match Docker\n  * Remove references to qcow2\n  * Fix typos in man page regarding transient storage mode.\n  * make: Use PYTHON var for .install.pre-commit\n  * Add containers.conf read-only flag support\n  * Explain that relabeling/chowning of volumes can take along time\n  * events: support \u0027die\u0027 filter\n  * infra/abi: refactor ContainerRm\n  * When in transient store mode, use rundir for bundlepath\n  * quadlet: Support Type=oneshot container files\n  * hacks/bats: keep QUADLET env var in test env\n  * New system tests for conflicting options\n  * Vendor in latest containers/(buildah, image, common)\n  * Output Size and Reclaimable in human form for json output\n  * podman service: close duplicated /dev/null fd\n  * ginkgo tests: apply ginkgolinter fixes\n  * Add support for hostPath and configMap subpath usage\n  * export: use io.Writer instead of file\n  * rootless: always create userns with euid != 0\n  * rootless: inhibit copy mapping for euid != 0\n  * pkg/domain/infra/abi: introduce `type containerWrapper`\n  * vendor: bump to buildah ca578b290144 and use new cache API\n  * quadlet: Handle booleans that have defaults better\n  * quadlet: Rename parser.LookupBoolean to LookupBooleanWithDefault\n  * Add podman-clean-transient.service service\n  * Stop recording annotations set to false\n  * Unify --noheading and -n to be consistent on all commands\n  * pkg/domain/infra/abi: add `getContainers`\n  * Update vendor of containters/(common, image)\n  * specfile: Drop user-add depedency from quadlet subpackage.\n  * quadlet: Default BINDIR to /usr/bin if tag not specified\n  * Quadlet: add network support\n  * Add comment for jsonMarshal command\n  * Always allow pushing from containers-storage\n  * libpod: move NetNS into state db instead of extra bucket\n  * Add initial system tests for quadlets\n  * quadlet: Add --user option\n  * libpod: remove CNI word were no longer applicable\n  * libpod: fix header length in http attach with logs\n  * podman-kube@ template: use `podman kube`\n  * build(deps): bump github.com/docker/docker\n  * wait: add --ignore option\n  * qudlet: Respect $PODMAN env var for podman binary\n  * e2e: Add assert-key-is-regex check to quadlet e2e testsuite\n  * e2e: Add some assert to quadlet test to make sure testcases are sane\n  * remove unmapped ports from inspect port bindings\n  * update podman-network-create for clarity\n  * Vendor in latest containers/common with default capabilities\n  * pkg/rootless: Change error text ...\n  * rootless: add cli validator\n  * rootless: define LIBEXECPODMAN\n  * doc: fix documentation for idmapped mounts\n  * bump golangci-lint to v1.50.1\n  * build(deps): bump github.com/onsi/gomega from 1.24.1 to 1.24.2\n  * [CI:DOCS] podman-mount: s/umount/unmount/\n  * create/pull --help: list pull policies\n  * Network Create: Add --ignore flag to support idempotent script\n  * Make qemu security model none\n  * libpod: use OCI idmappings for mounts\n  * stop reporting errors removing containers that don\u0027t exist\n  * test: added test from wait endpoint with to long label\n  * quadlet: Default VolatileTmp to off\n  * build(deps): bump github.com/ulikunitz/xz from 0.5.10 to 0.5.11\n  * docs/options/ipc: fix list syntax\n  * Docs: Add dedicated DOWNLOAD doc w/ links to bins\n  * Make a consistently-named windows installer\n  * checkpoint restore: fix --ignore-static-ip/mac\n  * add support for subpath in play kube for named volumes\n  * build(deps): bump golang.org/x/net from 0.2.0 to 0.4.0\n  * golangci-lint: remove three deprecated linters\n  * parse-localbenchmarks: separate standard deviation\n  * build(deps): bump golang.org/x/term from 0.2.0 to 0.3.0\n  * podman play kube support container startup probe\n  * Add podman buildx version support\n  * Cirrus: Collect benchmarks on machine instances\n  * Cirrus: Remove escape codes from log files\n  * [CI:DOCS] Clarify secret target behavior\n  * Fix typo on network docs\n  * podman-remote build add --volume support\n  * remote: allow --http-proxy for remote clients\n  * Cleanup kube play workloads if error happens\n  * health check: ignore dependencies of transient systemd units/timers\n  * fix: event read from syslog\n  * Fixes secret (un)marshaling for kube play.\n  * Remove \u0027you\u0027 from man pages\n  * build(deps): bump golang.org/x/tools from 0.3.0 to 0.4.0 in /test/tools\n  * [CI:DOCS] test/README.md: run tests with podman-remote\n  * e2e: keeps the http_proxy value\n  * Makefile: Add podman-mac-helper to darwin client zip\n  * test/e2e: enable \u0027podman run with ipam none driver\u0027 for nv\n  * [skip-ci] GHA/Cirrus-cron: Fix execution order\n  * kube sdnotify: run proxies for the lifespan of the service\n  * Update containers common package\n  * podman manpage: Use man-page links instead of file names\n  * e2e: fix e2e tests in proxy environment\n  * Fix test\n  * disable healthchecks automatically on non systemd systems\n  * Quadlet Kube: Add support for userns flag\n  * [CI:DOCS] Add warning about --opts,o with mount\u0027s -o\n  * Add podman system prune --external\n  * Add some tests for transient store\n  * runtime: In transient_store mode, move bolt_state.db to rundir\n  * runtime: Handle the transient store options\n  * libpod: Move the creation of TmpDir to an earlier time\n  * network create: support \u0027-o parent=XXX\u0027 for ipvlan\n  * compat API: allow MacAddress on container config\n  * Quadlet Kube: Add support for relative path for YAML file\n  * notify k8s system test: move sending message into exec\n  * runtime: do not chown idmapped volumes\n  * quadlet: Drop ExecStartPre=rm %t/%N.cid\n  * Quadlet Kube: Set SyslogIdentifier if was not set\n  * Add a FreeBSD cross build to the cirrus alt build task\n  * Add completion for --init-ctr\n  * Fix handling of readonly containers when defined in kube.yaml\n  * Build cross-compilation fixes\n  * libpod: Track healthcheck API changes in healthcheck_unsupported.go\n  * quadlet: Use same default capability set as podman run\n  * quadlet: Drop --pull=never\n  * quadlet: Change default of ReadOnly to no\n  * quadlet: Change RunInit default to no\n  * quadlet: Change NoNewPrivileges default to false\n  * test: podman run with checkpoint image\n  * Enable \u0027podman run\u0027 for checkpoint images\n  * test: Add tests for checkpoint images\n  * CI setup: simplify environment passthrough code\n  * Init containers should not be restarted\n  * Update c/storage after https://github.com/containers/storage/pull/1436\n  * Set the latest release explicitly\n  * add friendly comment\n  * fix an overriding logic and load config problem\n  * Update the issue templates\n  * Update vendor of containers/(image, buildah)\n  * [CI:DOCS] Skip windows-smoke when not useful\n  * [CI:DOCS] Remove broken gate-container docs\n  * OWNERS: add Jason T. Greene\n  * hack/podmansnoop: print arguments\n  * Improve atomicity of VM state persistence on Windows\n  * [CI:BUILD] copr: enable podman-restart.service on rpm installation\n  * macos: pkg: Use -arm64 suffix instead of -aarch64\n  * linux: Add -linux suffix to podman-remote-static binaries\n  * linux: Build amd64 and arm64 podman-remote-static binaries\n  * container create: add inspect data to event\n  * Allow manual override of install location\n  * Run codespell on code\n  * Add missing parameters for checkpoint/restore endpoint\n  * Add support for startup healthchecks\n  * Add information on metrics to the `network create` docs\n  * Introduce podman machine os commands\n  * Document that ignoreRootFS depends on export/import\n  * Document ignoreVolumes in checkpoint/restore endpoint\n  * Remove leaveRunning from swagger restore endpoint\n  * libpod: Add checks to avoid nil pointer dereference if network setup fails\n  * Address golangci-lint issues\n  * Documenting Hyper-V QEMU acceleration settings\n  * Kube Play: fix the handling of the optional field of SecretVolumeSource\n  * Update Vendor of containers/(common, image, buildah)\n  * Fix swapped NetInput/-Output stats\n  * libpod: Use O_CLOEXEC for descriptors returned by (*Container).openDirectory\n  * chore: Fix MD for Troubleshooting Guide link in GitHub Issue Template\n  * test/tools: rebuild when files are changed\n  * ginkgo tests: apply ginkgolinter fixes\n  * ginkgo: restructure install work flow\n  * Fix manpage emphasis\n  * specgen: support CDI devices from containers.conf\n  * vendor: update containers/common\n  * pkg/trust: Take the default policy path from c/common/pkg/config\n  * Add validate-in-container target\n  * Adding encryption decryption feature\n  * container restart: clean up healthcheck state\n  * Add support for podman-remote manifest annotate\n  * Quadlet: Add support for .kube files\n  * Update vendor of containers/(buildah, common, storage, image)\n  * specgen: honor user namespace value\n  * [CI:DOCS] Migrate OSX Cross to M1\n  * quadlet: Rework uid/gid remapping\n  * GHA: Fix cirrus re-run workflow for other repos.\n  * ssh system test: skip until it becomes a test\n  * shell completion: fix hard coded network drivers\n  * libpod: Report network setup errors properly on FreeBSD\n  * E2E Tests: change the registry for the search test to avoid authentication\n  * pkginstaller: install podman-mac-helper by default\n  * Fix language. Mostly spelling a -\u003e an\n  * podman machine: Propagate SSL_CERT_FILE and SSL_CERT_DIR to systemd environment.\n  * [CI:DOCS] Fix spelling and typos\n  * Modify man page of \u0027--pids-limit\u0027 option to correct a default value.\n  * Update docs/source/markdown/podman-remote.1.md\n  * Update pkg/bindings/connection.go\n  * Add more documentation on UID/GID Mappings with --userns=keep-id\n  * support podman-remote to connect tcpURL with proxy\n  * Removing the RawInput from the API output\n  * fix port issues for CONTAINER_HOST\n  * CI: Package versions: run in the \u0027main\u0027 step\n  * build(deps): bump github.com/rootless-containers/rootlesskit\n  * pkg/domain: Make checkExecPreserveFDs platform-specific\n  * e2e tests: fix restart race\n  * Fix podman --noout to suppress all output\n  * remove pod if creation has failed\n  * pkg/rootless: Implement rootless.IsFdInherited on FreeBSD\n  * Fix more podman-logs flakes\n  * healthcheck system tests: try to fix flake\n  * libpod: treat ESRCH from /proc/PID/cgroup as ENOENT\n  * GHA: Configure workflows for reuse\n  * compat,build: handle docker\u0027s preconfigured cacheTo,cacheFrom\n  * docs: deprecate pasta network name\n  * utils: Enable cgroup utils for FreeBSD\n  * pkg/specgen: Disable kube play tests on FreeBSD\n  * libpod/lock: Fix build and tests for SHM locks on FreeBSD\n  * podman cp: fix copying with \u0027.\u0027 suffix\n  * pkginstaller: bump Qemu to version 7.1.0\n  * specgen,wasm: switch to crun-wasm wherever applicable\n  * vendor: bump c/common to v0.50.2-0.20221111184705-791b83e1cdf1\n  * libpod: Make unit test for statToPercent Linux only\n  * Update vendor of containers/storage\n  * fix connection usage with containers.conf\n  * Add --quiet and --no-info flags to podman machine start\n  * Add hidden podman manifest inspect -v option\n  * Add podman volume create -d short option for driver\n  * Vendor in latest containers/(common,image,storage)\n  * Add podman system events alias to podman events\n  * Fix search_test to return correct version of alpine\n  * GHA: Fix undefined secret env. var.\n  * Release notes for 4.3.1\n  * GHA: Fix make_email-body script reference\n  * Add release keys to README\n  * GHA: Fix typo setting output parameter\n  * GHA: Fix typo.\n  * New tool, docs/version-check\n  * Formalize our compare-against-docker mechanism\n  * Add restart-sec for container service files\n  * test/tools: bump module to go 1.17\n  * contrib/cirrus/check_go_changes.sh: ignore test/tools/vendor\n  * build(deps): bump golang.org/x/tools from 0.1.12 to 0.2.0 in /test/tools\n  * libpod: Add FreeBSD support in packageVersion\n  * Allow podman manigest push --purge|-p as alias for --rm\n  * [CI:DOCS] Add performance tutorial\n  * [CI:DOCS] Fix build targets in build_osx.md.\n  * fix --format {{json .}} output to match docker\n  * remote: fix manifest add --annotation\n  * Skip test if `--events-backend` is necessary with podman-remote\n  * kube play: update the handling of PersistentVolumeClaim\n  * system tests: fix a system test in proxy environment\n  * Use single unqualified search registry on Windows\n  * test/system: Add, use tcp_port_probe() to check for listeners rather than binds\n  * test/system: Add tests for pasta(1) connectivity\n  * test/system: Move network-related helpers to helpers.network.bash\n  * test/system: Use procfs to find bound ports, with optional address and protocol\n  * test/system: Use port_is_free() from wait_for_port()\n  * libpod: Add pasta networking mode\n  * More log-flake work\n  * Fix test flakes caused by improper podman-logs\n  * fix incorrect systemd booted check\n  * Cirrus: Add tests for GHA scripts\n  * GHA: Update scripts to pass shellcheck\n  * Cirrus: Shellcheck github-action scripts\n  * Cirrus: shellcheck support for github-action scripts\n  * GHA: Fix cirrus-cron scripts\n  * Makefile: don\u0027t install to tmpfiles.d on FreeBSD\n  * Make sure we can build and read each line of docker py\u0027s api client\n  * Docker compat build api - make sure only one line appears per flush\n  * Run codespell on code\n  * Update vendor of containers/(image, storage, common)\n  * Allow namespace path network option for pods.\n  * Cirrus: Never skip running Windows Cross task\n  * GHA: Auto. re-run failed cirrus-cron builds once\n  * GHA: Migrate inline script to file\n  * GHA: Simplify script reference\n  * test/e2e: do not use apk in builds\n  * remove container/pod id file along with container/pod\n  * Cirrus: Synchronize windows image\n  * Add --insecure,--tls-verify,--verbose flags to podman manifest inspect\n  * runtime: add check for valid pod systemd cgroup\n  * CI: set and verify DESIRED_NETWORK (netavark, cni)\n  * [CI:DOCS] troubleshooting: document keep-id options\n  * Man pages: refactor common options: --security-opt\n  * Cirrus: Guarantee CNI testing w/o nv/av present\n  * Cirrus: temp. disable all Ubuntu testing\n  * Cirrus: Update to F37beta\n  * buildah bud tests: better handling of remote\n  * quadlet: Warn in generator if using short names\n  * Add Windows Smoke Testing\n  * Add podman kube apply command\n  * docs: offer advice on installing test dependencies\n  * Fix documentation on read-only-tmpfs\n  * version bump to 4.4.0-dev\n  * deps: bump go-criu to v6\n  * Makefile: Add cross build targets for freebsd\n  * pkg/machine: Make this build on FreeBSD/arm64\n  * pkg/rctl: Remove unused cgo dependency\n  * man pages: assorted underscore fixes\n  * Upgrade GitHub actions packages from v2 to v3\n  * vendor github.com/godbus/dbus/v5@4b691ce\n  * [CI:DOCS] fix --tmpdir typos\n  * Do not report that /usr/share/containers/storage.conf has been edited.\n  * Eval symlinks on XDG_RUNTIME_DIR\n  * hack/podmansnoop\n  * rootless: support keep-id with one mapping\n  * rootless: add argument to GetConfiguredMappings\n  * Update vendor containers/(common,storage,buildah,image)\n  * Fix deadlock between \u0027podman ps\u0027 and \u0027container inspect\u0027 commands\n  * Add information about where the libpod/boltdb database lives\n  * Consolidate the dependencies for the IsTerminal() API\n  * Ensure that StartAndAttach locks while sending signals\n  * ginkgo testing: fix podman usernamespace join\n  * Test runners: nuke podman from $PATH before tests\n  * volumes: Fix idmap not working for volumes\n  * FIXME: Temporary workaround for ubi8 CI breakage\n  * System tests: teardown: clean up volumes\n  * update api versions on docs.podman.io\n  * system tests: runlabel: use podman-under-test\n  * system tests: podman network create: use random port\n  * sig-proxy test: bump timeout\n  * play kube: Allow the user to import the contents of a tar file into a volume\n  * Clarify the docs on DropCapability\n  * quadlet tests: Disable kmsg logging while testing\n  * quadlet: Support multiple Network=\n  * quadlet: Add support for Network=...\n  * Fix manpage for podman run --network option\n  * quadlet: Add support for AddDevice=\n  * quadlet: Add support for setting seccomp profile\n  * quadlet: Allow multiple elements on each Add/DropCaps line\n  * quadlet: Embed the correct binary name in the generated comment\n  * quadlet: Drop the SocketActivated key\n  * quadlet: Switch log-driver to passthrough\n  * quadlet: Change ReadOnly to default to enabled\n  * quadlet tests: Run the tests even for (exected) failed tests\n  * quadlet tests: Fix handling of stderr checks\n  * Remove unused script file\n  * notifyproxy: fix container watcher\n  * container/pod id file: truncate instead of throwing an error\n  * quadlet: Use the new podman create volume --ignore\n  * Add podman volume create --ignore\n  * logcollector: include aardvark-dns\n  * build(deps): bump github.com/stretchr/testify from 1.8.0 to 1.8.1\n  * build(deps): bump github.com/BurntSushi/toml from 1.2.0 to 1.2.1\n  * docs: generate systemd: point to kube template\n  * docs: kube play: mention restart policy\n  * Fixes: 15858 (podman system reset --force destroy machine)\n  * fix search flake\n  * use cached containers.conf\n  * adding regex support to the ancestor ps filter function\n  * Fix `system df` issues with `-f` and `-v`\n  * markdown-preprocess: cross-reference where opts are used\n  * Default qemu flags for Windows amd64\n  * build(deps): bump golang.org/x/text from 0.3.8 to 0.4.0\n  * Update main to reflect v4.3.0 release\n  * build(deps): bump github.com/docker/docker\n  * move quadlet packages into pkg/systemd\n  * system df: fix image-size calculations\n  * Add man page for quadlet\n  * Fix small typo\n  * testimage: add iproute2 \u0026 socat, for pasta networking\n  * Set up minikube for k8s testing\n  * Makefile: don\u0027t install systemd generator binaries on FreeBSD\n  * [CI:BUILD] copr: podman rpm should depend on containers-common-extra\n  * Podman image: Set default_sysctls to empty for rootless containers\n  * Don\u0027t use  github.com/docker/distribution\n  * libpod: Add support for \u0027podman top\u0027 on FreeBSD\n  * libpod: Factor out jail name construction from stats_freebsd.go\n  * pkg/util: Add pid information descriptors for FreeBSD\n  * Initial quadlet version integrated in golang\n  * bump golangci-lint to v1.49.0\n  * Update vendor containers/(common,image,storage)\n  * Allow volume mount dups, iff source and dest dirs\n  * rootless: fix return value handling\n  * Change to correct break statements\n  * vendor containers/psgo@v1.8.0\n  * Clarify that MacOSX docs are client specific\n  * libpod: Factor out the call to PidFdOpen from (*Container).WaitForExit\n  * Add swagger install + allow version updates in CI\n  * Cirrus: Fix windows clone race\n  * build(deps): bump github.com/docker/docker\n  * kill: wait for the container\n  * generate systemd: set --stop-timeout for stopping containers\n  * hack/tree_status.sh: print diff at the end\n  * Fix markdown header typo\n  * markdown-preprocess: add generic include mechanism\n  * markdown-preprocess: almost complete OO rewrite\n  * Update tests for changed error messages\n  * Update c/image after https://github.com/containers/image/pull/1299\n  * Man pages: refactor common options (misc)\n  * Man pages: Refactor common options: --detach-keys\n  * vendor containers/storage@main\n  * Man pages: refactor common options: --attach\n  * build(deps): bump github.com/fsnotify/fsnotify from 1.5.4 to 1.6.0\n  * KillContainer: improve error message\n  * docs: add missing options\n  * Man pages: refactor common options: --annotation (manifest)\n  * build(deps): bump github.com/spf13/cobra from 1.5.0 to 1.6.0\n  * system tests: health-on-failure: fix broken logic\n  * build(deps): bump golang.org/x/text from 0.3.7 to 0.3.8\n  * build(deps): bump github.com/onsi/gomega from 1.20.2 to 1.22.1\n  * ContainerEngine.SetupRootless(): Avoid calling container.Config()\n  * Container filters: Avoid use of ctr.Config()\n  * Avoid unnecessary calls to Container.Spec()\n  * Add and use Container.LinuxResource() helper\n  * play kube: notifyproxy: listen before starting the pod\n  * play kube: add support for configmap binaryData\n  * Add and use libpod/Container.Terminal() helper\n  * Revert \u0027Add checkpoint image tests\u0027\n  * Revert \u0027cmd/podman: add support for checkpoint images\u0027\n  * healthcheck: fix --on-failure=stop\n  * Man pages: Add mention of behavior due to XDG_CONFIG_HOME\n  * build(deps): bump github.com/containers/ocicrypt from 1.1.5 to 1.1.6\n  * Avoid unnecessary timeout of 250msec when waiting on container shutdown\n  * health checks: make on-failure action retry aware\n  * libpod: Remove 100msec delay during shutdown\n  * libpod: Add support for \u0027podman pod\u0027 on FreeBSD\n  * libpod: Factor out cgroup validation from (*Runtime).NewPod\n  * libpod: Move runtime_pod_linux.go to runtime_pod_common.go\n  * specgen/generate: Avoid a nil dereference in MakePod\n  * libpod: Factor out cgroups handling from (*Pod).refresh\n  * Adds a link to OSX docs in CONTRIBUTING.md\n  * Man pages: refactor common options: --os-version\n  * Create full path to a directory when DirectoryOrCreate is used with play kube\n  * Return error in podman system service if URI scheme is not unix/tcp\n  * Man pages: refactor common options: --time\n  * man pages: document some --format options: images\n  * Clean up when stopping pods\n  * Update vendor of containers/buildah v1.28.0\n  * Proof of concept: nightly dependency treadmill\n\n- Make the priority for picking the storage driver configurable (bsc#1197093)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2023-1814,SUSE-SLE-Micro-5.3-2023-1814,SUSE-SLE-Micro-5.4-2023-1814,SUSE-SLE-Module-Containers-15-SP4-2023-1814,openSUSE-Leap-Micro-5.3-2023-1814,openSUSE-SLE-15.4-2023-1814",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_1814-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2023:1814-1",
        "url": "https://www.suse.com/support/update/announcement/2023/suse-su-20231814-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2023:1814-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-May/014735.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1197093",
        "url": "https://bugzilla.suse.com/1197093"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1208364",
        "url": "https://bugzilla.suse.com/1208364"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1208510",
        "url": "https://bugzilla.suse.com/1208510"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209495",
        "url": "https://bugzilla.suse.com/1209495"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-0778 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-0778/"
      }
    ],
    "title": "Security update for podman",
    "tracking": {
      "current_release_date": "2023-04-11T12:40:40Z",
      "generator": {
        "date": "2023-04-11T12:40:40Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2023:1814-1",
      "initial_release_date": "2023-04-11T12:40:40Z",
      "revision_history": [
        {
          "date": "2023-04-11T12:40:40Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-4.4.4-150400.4.16.1.aarch64",
                "product": {
                  "name": "podman-4.4.4-150400.4.16.1.aarch64",
                  "product_id": "podman-4.4.4-150400.4.16.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-4.4.4-150400.4.16.1.aarch64",
                "product": {
                  "name": "podman-remote-4.4.4-150400.4.16.1.aarch64",
                  "product_id": "podman-remote-4.4.4-150400.4.16.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-4.4.4-150400.4.16.1.i586",
                "product": {
                  "name": "podman-4.4.4-150400.4.16.1.i586",
                  "product_id": "podman-4.4.4-150400.4.16.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-4.4.4-150400.4.16.1.i586",
                "product": {
                  "name": "podman-remote-4.4.4-150400.4.16.1.i586",
                  "product_id": "podman-remote-4.4.4-150400.4.16.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-cni-config-4.4.4-150400.4.16.1.noarch",
                "product": {
                  "name": "podman-cni-config-4.4.4-150400.4.16.1.noarch",
                  "product_id": "podman-cni-config-4.4.4-150400.4.16.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "podman-docker-4.4.4-150400.4.16.1.noarch",
                "product": {
                  "name": "podman-docker-4.4.4-150400.4.16.1.noarch",
                  "product_id": "podman-docker-4.4.4-150400.4.16.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-4.4.4-150400.4.16.1.ppc64le",
                "product": {
                  "name": "podman-4.4.4-150400.4.16.1.ppc64le",
                  "product_id": "podman-4.4.4-150400.4.16.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-4.4.4-150400.4.16.1.ppc64le",
                "product": {
                  "name": "podman-remote-4.4.4-150400.4.16.1.ppc64le",
                  "product_id": "podman-remote-4.4.4-150400.4.16.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-4.4.4-150400.4.16.1.s390x",
                "product": {
                  "name": "podman-4.4.4-150400.4.16.1.s390x",
                  "product_id": "podman-4.4.4-150400.4.16.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-4.4.4-150400.4.16.1.s390x",
                "product": {
                  "name": "podman-remote-4.4.4-150400.4.16.1.s390x",
                  "product_id": "podman-remote-4.4.4-150400.4.16.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-4.4.4-150400.4.16.1.x86_64",
                "product": {
                  "name": "podman-4.4.4-150400.4.16.1.x86_64",
                  "product_id": "podman-4.4.4-150400.4.16.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-4.4.4-150400.4.16.1.x86_64",
                "product": {
                  "name": "podman-remote-4.4.4-150400.4.16.1.x86_64",
                  "product_id": "podman-remote-4.4.4-150400.4.16.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.3",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.3",
                  "product_id": "SUSE Linux Enterprise Micro 5.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.4",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.4",
                  "product_id": "SUSE Linux Enterprise Micro 5.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Containers 15 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Containers 15 SP4",
                  "product_id": "SUSE Linux Enterprise Module for Containers 15 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-containers:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap Micro 5.3",
                "product": {
                  "name": "openSUSE Leap Micro 5.3",
                  "product_id": "openSUSE Leap Micro 5.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap-micro:5.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.4",
                "product": {
                  "name": "openSUSE Leap 15.4",
                  "product_id": "openSUSE Leap 15.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.s390x"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-cni-config-4.4.4-150400.4.16.1.noarch as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch"
        },
        "product_reference": "podman-cni-config-4.4.4-150400.4.16.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.aarch64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.aarch64"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.s390x as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.s390x"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.x86_64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.x86_64"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-cni-config-4.4.4-150400.4.16.1.noarch as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:podman-cni-config-4.4.4-150400.4.16.1.noarch"
        },
        "product_reference": "podman-cni-config-4.4.4-150400.4.16.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.aarch64 as component of SUSE Linux Enterprise Module for Containers 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.aarch64"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Containers 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.ppc64le as component of SUSE Linux Enterprise Module for Containers 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.ppc64le"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Containers 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.s390x as component of SUSE Linux Enterprise Module for Containers 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.s390x"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Containers 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.x86_64 as component of SUSE Linux Enterprise Module for Containers 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.x86_64"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Containers 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-cni-config-4.4.4-150400.4.16.1.noarch as component of SUSE Linux Enterprise Module for Containers 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Containers 15 SP4:podman-cni-config-4.4.4-150400.4.16.1.noarch"
        },
        "product_reference": "podman-cni-config-4.4.4-150400.4.16.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Containers 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-docker-4.4.4-150400.4.16.1.noarch as component of SUSE Linux Enterprise Module for Containers 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Containers 15 SP4:podman-docker-4.4.4-150400.4.16.1.noarch"
        },
        "product_reference": "podman-docker-4.4.4-150400.4.16.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Containers 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.4.4-150400.4.16.1.aarch64 as component of SUSE Linux Enterprise Module for Containers 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.aarch64"
        },
        "product_reference": "podman-remote-4.4.4-150400.4.16.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Containers 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.4.4-150400.4.16.1.ppc64le as component of SUSE Linux Enterprise Module for Containers 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.ppc64le"
        },
        "product_reference": "podman-remote-4.4.4-150400.4.16.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Containers 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.4.4-150400.4.16.1.s390x as component of SUSE Linux Enterprise Module for Containers 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.s390x"
        },
        "product_reference": "podman-remote-4.4.4-150400.4.16.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Containers 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.4.4-150400.4.16.1.x86_64 as component of SUSE Linux Enterprise Module for Containers 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.x86_64"
        },
        "product_reference": "podman-remote-4.4.4-150400.4.16.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Containers 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.aarch64 as component of openSUSE Leap Micro 5.3",
          "product_id": "openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.x86_64 as component of openSUSE Leap Micro 5.3",
          "product_id": "openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-cni-config-4.4.4-150400.4.16.1.noarch as component of openSUSE Leap Micro 5.3",
          "product_id": "openSUSE Leap Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch"
        },
        "product_reference": "podman-cni-config-4.4.4-150400.4.16.1.noarch",
        "relates_to_product_reference": "openSUSE Leap Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.aarch64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.aarch64"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.ppc64le as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.ppc64le"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.s390x as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.s390x"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.4.4-150400.4.16.1.x86_64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.x86_64"
        },
        "product_reference": "podman-4.4.4-150400.4.16.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-cni-config-4.4.4-150400.4.16.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:podman-cni-config-4.4.4-150400.4.16.1.noarch"
        },
        "product_reference": "podman-cni-config-4.4.4-150400.4.16.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-docker-4.4.4-150400.4.16.1.noarch as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:podman-docker-4.4.4-150400.4.16.1.noarch"
        },
        "product_reference": "podman-docker-4.4.4-150400.4.16.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.4.4-150400.4.16.1.aarch64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.aarch64"
        },
        "product_reference": "podman-remote-4.4.4-150400.4.16.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.4.4-150400.4.16.1.ppc64le as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.ppc64le"
        },
        "product_reference": "podman-remote-4.4.4-150400.4.16.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.4.4-150400.4.16.1.s390x as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.s390x"
        },
        "product_reference": "podman-remote-4.4.4-150400.4.16.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.4.4-150400.4.16.1.x86_64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.x86_64"
        },
        "product_reference": "podman-remote-4.4.4-150400.4.16.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-0778",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-0778"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch",
          "SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:podman-cni-config-4.4.4-150400.4.16.1.noarch",
          "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.aarch64",
          "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.ppc64le",
          "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.s390x",
          "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.x86_64",
          "SUSE Linux Enterprise Module for Containers 15 SP4:podman-cni-config-4.4.4-150400.4.16.1.noarch",
          "SUSE Linux Enterprise Module for Containers 15 SP4:podman-docker-4.4.4-150400.4.16.1.noarch",
          "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.aarch64",
          "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.ppc64le",
          "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.s390x",
          "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.x86_64",
          "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.aarch64",
          "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.ppc64le",
          "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.s390x",
          "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.x86_64",
          "openSUSE Leap 15.4:podman-cni-config-4.4.4-150400.4.16.1.noarch",
          "openSUSE Leap 15.4:podman-docker-4.4.4-150400.4.16.1.noarch",
          "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.aarch64",
          "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.ppc64le",
          "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.s390x",
          "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.x86_64",
          "openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64",
          "openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64",
          "openSUSE Leap Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-0778",
          "url": "https://www.suse.com/security/cve/CVE-2023-0778"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1208364 for CVE-2023-0778",
          "url": "https://bugzilla.suse.com/1208364"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch",
            "SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-cni-config-4.4.4-150400.4.16.1.noarch",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.aarch64",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.ppc64le",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.s390x",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.x86_64",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-cni-config-4.4.4-150400.4.16.1.noarch",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-docker-4.4.4-150400.4.16.1.noarch",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.aarch64",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.ppc64le",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.s390x",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.x86_64",
            "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.aarch64",
            "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.ppc64le",
            "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.s390x",
            "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.x86_64",
            "openSUSE Leap 15.4:podman-cni-config-4.4.4-150400.4.16.1.noarch",
            "openSUSE Leap 15.4:podman-docker-4.4.4-150400.4.16.1.noarch",
            "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.aarch64",
            "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.ppc64le",
            "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.s390x",
            "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.x86_64",
            "openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64",
            "openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64",
            "openSUSE Leap Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch",
            "SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-4.4.4-150400.4.16.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-cni-config-4.4.4-150400.4.16.1.noarch",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.aarch64",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.ppc64le",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.s390x",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-4.4.4-150400.4.16.1.x86_64",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-cni-config-4.4.4-150400.4.16.1.noarch",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-docker-4.4.4-150400.4.16.1.noarch",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.aarch64",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.ppc64le",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.s390x",
            "SUSE Linux Enterprise Module for Containers 15 SP4:podman-remote-4.4.4-150400.4.16.1.x86_64",
            "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.aarch64",
            "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.ppc64le",
            "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.s390x",
            "openSUSE Leap 15.4:podman-4.4.4-150400.4.16.1.x86_64",
            "openSUSE Leap 15.4:podman-cni-config-4.4.4-150400.4.16.1.noarch",
            "openSUSE Leap 15.4:podman-docker-4.4.4-150400.4.16.1.noarch",
            "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.aarch64",
            "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.ppc64le",
            "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.s390x",
            "openSUSE Leap 15.4:podman-remote-4.4.4-150400.4.16.1.x86_64",
            "openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.aarch64",
            "openSUSE Leap Micro 5.3:podman-4.4.4-150400.4.16.1.x86_64",
            "openSUSE Leap Micro 5.3:podman-cni-config-4.4.4-150400.4.16.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-11T12:40:40Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-0778"
    }
  ]
}