Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-09-15T00:00:00 podman: buildah: skopeo: containers/storage: Malicious tar whiteout header allows replacement of extraction destination directory 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L CWE-59

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Red Hat container tools are not directly affected by this flaw, which primarily impacts external applications that directly call the containers/storage library API. Successful exploitation requires processing a specially crafted tar archive containing a malicious whiteout header, leading to the replacement of an extraction destination directory. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-24/eda-controller-rhel8 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-25/eda-controller-rhel8 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred python3.11-podman Red Hat Ansible Automation Platform 2 Fix deferred python3.12-podman Red Hat Ansible Automation Platform 2 Fix deferred python3x-podman Red Hat Ansible Automation Platform 2 Fix deferred python-podman Red Hat Enterprise Linux 10 Fix deferred buildah Red Hat Enterprise Linux 10 Fix deferred podman Red Hat Enterprise Linux 10 Fix deferred skopeo Red Hat Enterprise Linux 8 Fix deferred buildah Red Hat Enterprise Linux 8 Fix deferred podman Red Hat Enterprise Linux 8 Fix deferred skopeo Red Hat Enterprise Linux 9 Fix deferred buildah Red Hat Enterprise Linux 9 Fix deferred podman Red Hat Enterprise Linux 9 Fix deferred python-podman Red Hat Enterprise Linux 9 Fix deferred rhel9/buildah Red Hat Enterprise Linux 9 Fix deferred rhel9/podman Red Hat Enterprise Linux 9 Fix deferred rhel9/skopeo Red Hat Enterprise Linux 9 Fix deferred skopeo Red Hat Hardened Images Affected buildah Red Hat Hardened Images Affected podman Red Hat Hardened Images Affected skopeo Red Hat OpenShift Container Platform 4 Fix deferred podman Red Hat OpenShift Container Platform 4 Fix deferred skopeo Red Hat OpenShift Dev Spaces Fix deferred devspaces/udi-base-rhel10 Red Hat OpenShift Dev Spaces Fix deferred devspaces/udi-base-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/udi-rhel9 Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/ocp-virt-validation-checkup-rhel9 Red Hat Quay 3 Fix deferred quay/quay-builder-rhel8 Red Hat Quay 3 Fix deferred quay/quay-builder-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-79699 https://nvd.nist.gov/vuln/detail/CVE-2026-79699