Build Context Bind Mount
CVE: CVE-2025-4953
Component: podman
CWE: CWE-378
Severity: Moderate
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-09-16T00:00:00+00:00

A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files accessible.

Statement: This issue is classified as Moderate rather than Important because exploitation requires several preconditions: an attacker must have unprivileged access to the host during the build process, the container build must include long-running steps (e.g., RUN sleep) that prolong the existence of the temporary build context, and files must be created with overly permissive permissions (e.g., 4777). The vulnerability does not allow remote code execution or compromise of running containers, and it only exposes files temporarily present in the build context. Therefore, while it can lead to information disclosure, the scope and impact are limited to local users with concurrent access, making the overall risk moderate.

Remediation:
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes

You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:9ea794d2dd24ff7377534edfb0447e5398a28919a84300cc79fe7bb8ae550d1b

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4. 13see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
For OpenShift Container Platform 4.16 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/
For OpenShift Container Platform 4.13 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:384dcc2b7dde97674e4197b6e4130268adc2b00a94908aa9220a4061aa1030ac

All OpenShift Container Platform 4.13 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.14 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:c551518a35fb3fb5c9887d251194f2aa20564a8bc95d2720bedbd4a0dbca3865

      (For s390x architecture)
      The image digest is sha256:9463efebb29a5874295297010675109a8fae10badfa54b02ecd8b74c3cdefd42

      (For ppc64le architecture)
      The image digest is sha256:8962ab30587eb59760e4544b94a467f749daed99818b568813b1dcbc9d031104

      (For aarch64 architecture)
      The image digest is sha256:c84de983bbafde38cdaab06af268a898932fc9fb0167e492a123ca0a553b3241

All OpenShift Container Platform 4.14 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:39236e073ff4b62406a472178263fd2220b0f544c3fd26036120b470596fa255

      (For s390x architecture)
      The image digest is sha256:f94d7fce531623dd0d1d4b5fe1c299eba7152676306ed2e9ea3c7fe17b4ad5ee

      (For ppc64le architecture)
      The image digest is sha256:5cdc5d1a0cb3b990afbaa8d1559abf87d9194c375541f27689aa974c1336d9eb

      (For aarch64 architecture)
      The image digest is sha256:584bb60432b0460d97b9624a3cb1c625469534ac44dedb618f14834161c2d448

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:5efb10e511ff6623fee08dd8cfa8915b9be5cc3b7f7501731ddc13fa0d2ea988

      (For s390x architecture)
      The image digest is sha256:2b77c206c6ab23808a1b3988f7e87f4dae14dbc57bf300e1ce1eabc945667b64

      (For ppc64le architecture)
      The image digest is sha256:6cbdd40976744d791db379a0c6d1a4203a17cf0f31a865e19916025647b7244a

      (For aarch64 architecture)
      The image digest is sha256:c71acfbc01a33e3cce8f02f3f2354409c3a00bfdaa46f0b4f53ac8ee8e763d8a

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:4f7b8774832b0928a98ffc519637a6e1e4fe085754a0e9d240104993f7ce940b

      (For s390x architecture)
      The image digest is sha256:fe6abf197b86cae6a7346a8564efb809d5192341ae1c63fd0a07980399b69173

      (For ppc64le architecture)
      The image digest is sha256:eb371d1bef44af03c7bb53e5ee994e02e88129814331d2d1cfe5d1a207389510

      (For aarch64 architecture)
      The image digest is sha256:bc53841307c98fb7b0585d708835311253396a20900a533d6b34800d1587d561

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:349912ef80ff71bdb591b36d8b3eca9df2446fa2497af08058d1777b8e0cf3ca

      (For s390x architecture)
      The image digest is sha256:4e91ca0d06c402ddf30399d5516277aed494d22b14f491b1fe0d5e06bcef7353

      (For ppc64le architecture)
      The image digest is sha256:b6a676f3dd9def22709ba94e6b9d66c37ae8057bce92fa930c8dec0f9f35197b

      (For aarch64 architecture)
      The image digest is sha256:068c24cfa13ceae36c1f0c82d083bab31223ffb1afa0d24ae044df633dc9f4bb

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
Avoid long-running build steps and overly permissive file permissions. Use RUN --mount=type=secret for sensitive data instead of bind mounts.