Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
HIGH severity

CVE-2022-1227 — v3

HIGH

CVE-2022-1227 is a high-severity (CVSS 8.8) CWE-281 vulnerability in github.com/containers/podman/v3. 1 public exploit reference exists, so weaponization risk is real. A fix is available for github.com/containers/podman/v3 — see the affected versions and patch details below.

Podman publishes a malicious image to public registries

Also known asGHSA-66vw-v2x9-hw75GO-2022-0558
Published
Apr 29, 2022
Updated
Aug 12, 2026
Affected
2 pkgs
Patched
2 / 2
Exploits
1 known
Exploitation data as of Sep 19, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
4.2%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs91th percentile — riskier than 91% of all scored CVEsHighest risk

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

How urgent is this, really

CVE-2022-1227 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.

Where this sits among everything scored

Of 377,166 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.

Real-World Exposure

2 pkgs affected
🐹github.com/containers/podman/v3🐹github.com/containers/psgo

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/containers/podman/v3all versions3.4go get github.com/containers/podman/v3@v3.4
🐹Gogithub.com/containers/psgoall versions1.7.2go get github.com/containers/psgo@v1.7.2
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

A privilege escalation flaw was found in Podman. This flaw allows an att…

github.comNVDMay 2022

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/containers/podman/v3, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/containers/podman/v3 to 3.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-1227 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2022-1227 can be triaged on real exposure rather than presence alone.

Tailored to CVE-2022-1227. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant
ProductFixed inAdvisory
Red Hat Enterprise Linux 7 Extraspodman-0:1.6.4-32.el7_9RHSA-2022:2190
Red Hat Enterprise Linux 8container-tools:rhel8-8060020220401155929.2e213529RHSA-2022:1762
Red Hat Enterprise Linux 8container-tools:3.0-8060020220419093427.3b538bd8RHSA-2022:2143
Red Hat Enterprise Linux 8.2 Extended Update Supportcontainer-tools:2.0-8020020220420173758.28c38760RHSA-2022:4651
Red Hat Enterprise Linux 8.4 Extended Update Supportcontainer-tools:3.0-8040020220419093313.c0c392d5RHSA-2022:4816
Red Hat Enterprise Linux 8.4 Extended Update Supportcontainer-tools:rhel8-8040020220623181602.c0c392d5RHSA-2022:5622
Red Hat OpenShift Container Platform 4.6podman-0:1.9.3-5.rhaos4.6.el8RHSA-2022:2263

Frequently Asked Questions

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.
O3 Security · Impact-Aware SCA

Is CVE-2022-1227 in your dependencies?

O3 Security finds CVE-2022-1227 across Go dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works
CVE-2022-1227: v3 PrivEsc (High 8.8) | O3 Security