[CLSA-2026:1790729698] podman: Fix of CVE-2026-39830
Type:
security
Severity:
Important
Release date:
2026-09-30 00:55:11 UTC
Description:
- CVE-2026-39830: discard unsolicited global and channel request responses instead of blocking the connection's read loop, and drain stale responses before sending a request, in the golang.org/x/crypto/ssh copies vendored by podman and by the bundled gvisor-tap-vsock (gvproxy)
CVEs fixed:
Updated packages:
  • podman-4.4.1-13.el9_2.tuxcare.els20.aarch64.rpm
    sha:5a2301c970712dde1889f194d71b4bcc336578fad1ff8312bc8fcce386668365
  • podman-4.4.1-13.el9_2.tuxcare.els20.x86_64.rpm
    sha:32d841167b88b89a02ce69bdcf2a673127a7fb39f104b8a3de1d2a97e790e1fa
  • podman-docker-4.4.1-13.el9_2.tuxcare.els20.noarch.rpm
    sha:66dde0adc2dd1a8f3a5ef28b8f8883c6609c24c0d89d8fd2e6b2e96f32e4fa00
  • podman-gvproxy-4.4.1-13.el9_2.tuxcare.els20.aarch64.rpm
    sha:0de40c7d10517cb7e638412c1fc412804a772bc2f04a21efef389e799da07d57
  • podman-gvproxy-4.4.1-13.el9_2.tuxcare.els20.x86_64.rpm
    sha:dc94c0fa3820a093bddb5901bddf014f1d549a8a100e7b27260ebec2cf1b3edb
  • podman-plugins-4.4.1-13.el9_2.tuxcare.els20.aarch64.rpm
    sha:0160d72fc0d9376715a54e2164a68c6c52794e15f68ba5cbc3a1a7202a776db4
  • podman-plugins-4.4.1-13.el9_2.tuxcare.els20.x86_64.rpm
    sha:a333193fae61becddffa79dc4b1abdf90f20a694f4675902cfafc264290074e6
  • podman-remote-4.4.1-13.el9_2.tuxcare.els20.aarch64.rpm
    sha:f9533699ea040213fd2b93b22443717b23d1c010bfd2fc3281fd17750868af91
  • podman-remote-4.4.1-13.el9_2.tuxcare.els20.x86_64.rpm
    sha:f2369826c0eb3f57a2c9d1b30cadd8d94fe4d41b7fcf7fa8edffa550c68d2282
  • podman-tests-4.4.1-13.el9_2.tuxcare.els20.aarch64.rpm
    sha:be09289ee71ffef8ce5e616ed3f989de8f773034133157d22336c75cc8e94566
  • podman-tests-4.4.1-13.el9_2.tuxcare.els20.x86_64.rpm
    sha:8ba11325b98445852adc7a92f5fe6b78ea8de69ff6889ecf4e522695cb551d86
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.