CVE-2025-8283 (CNNVD-202507-3444)
中文标题:
Red Hat Enterprise Linux 安全漏洞
英文标题:
Netavark: podman: netavark may resolve hostnames to unexpected hosts
漏洞描述
中文描述:
Red Hat Enterprise Linux是美国红帽（Red Hat）公司的面向企业用户的Linux操作系统。 Red Hat Enterprise Linux存在安全漏洞，该漏洞源于DNS搜索域移除，可能导致连接转发至意外外部服务器。
英文描述:
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - | - | - |
cpe:/o:redhat:enterprise_linux:10
|
| Red Hat | Red Hat Enterprise Linux 8 | - | - | - |
cpe:/o:redhat:enterprise_linux:8
|
| Red Hat | Red Hat Enterprise Linux 9 | - | - | - |
cpe:/o:redhat:enterprise_linux:9
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - | - | - |
cpe:/a:redhat:openshift:4
|
| redhat | openshift_container_platform | 4.0 | - | - |
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
|
| redhat | enterprise_linux | 8.0 | - | - |
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
|
| redhat | enterprise_linux | 9.0 | - | - |
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
|
| redhat | enterprise_linux | 10.0 | - | - |
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-8283 |
2025-11-11 15:23:37 | 2025-11-11 07:40:52 |
| NVD | nvd_CVE-2025-8283 |
2025-11-11 15:00:57 | 2025-11-11 07:48:39 |
| CNNVD | cnnvd_CNNVD-202507-3444 |
2025-11-11 15:12:51 | 2025-11-11 08:00:02 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202507-3444
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 5 -> 8
- data_sources: ['cve'] -> ['cve', 'nvd']