CVE-2025-8283

A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-8283	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2383941	Issue Tracking
https://github.com/advisories/GHSA-rpcf-rmh6-42xr
https://github.com/containers/netavark/releases/tag/v1.15.1

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:openshift_container_platform:4.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:10.0:::::::*

History

07 Nov 2025, 22:15

Type	Values Removed	Values Added
References		() https://github.com/advisories/GHSA-rpcf-rmh6-42xr - () https://github.com/containers/netavark/releases/tag/v1.15.1 -

Information

Published : 2025-07-28 19:15

Updated : 2025-11-07 22:15

NVD link : CVE-2025-8283

Mitre link : CVE-2025-8283

CVE.ORG link : CVE-2025-8283

JSON object : View

Products Affected

redhat

openshift_container_platform
enterprise_linux

CWE

CWE-15

External Control of System or Configuration Setting

{"id": "CVE-2025-8283", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2025-07-28T19:15:43.957", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-8283", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383941", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://github.com/advisories/GHSA-rpcf-rmh6-42xr", "source": "[email protected]"}, {"url": "https://github.com/containers/netavark/releases/tag/v1.15.1", "source": "[email protected]"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-15"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en el paquete netavark, una pila de red para contenedores utilizados con Podman. Debido a la eliminaci\u00f3n del dominio de b\u00fasqueda dns.podman, netavark podr\u00eda devolver servidores externos si se env\u00eda un registro A/AAAA v\u00e1lido como respuesta. Al crear un contenedor con un nombre determinado, este se usar\u00e1 como nombre de host del contenedor. Dado que el dominio de b\u00fasqueda de Podman ya no se agrega, el contenedor utiliza el archivo resolv.conf del host y el solucionador DNS intentar\u00e1 buscar en los dominios de b\u00fasqueda que contiene. Si uno de los dominios contiene el mismo nombre de host que el contenedor en ejecuci\u00f3n, la conexi\u00f3n se redireccionar\u00e1 a servidores externos inesperados."}], "lastModified": "2025-11-07T22:15:39.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "932D137F-528B-4526-9A89-CD59FA1AB0FE"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}