CVE-2025-8283— Netavark: podman: netavark may resolve hostnames to unexpected hosts
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-8283
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Netavark: podman: netavark may resolve hostnames to unexpected hosts
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
系统设置或配置在外部可控制
Source: NVD (National Vulnerability Database)
Vulnerability Title
Red Hat Enterprise Linux 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat Enterprise Linux是美国红帽（Red Hat）公司的面向企业用户的Linux操作系统。 Red Hat Enterprise Linux存在安全漏洞，该漏洞源于DNS搜索域移除，可能导致连接转发至意外外部服务器。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - | cpe:/o:redhat:enterprise_linux:10 | |
| Red Hat | Red Hat Enterprise Linux 8 | - | cpe:/o:redhat:enterprise_linux:8 | |
| Red Hat | Red Hat Enterprise Linux 8 | - | cpe:/o:redhat:enterprise_linux:8 | |
| Red Hat | Red Hat Enterprise Linux 9 | - | cpe:/o:redhat:enterprise_linux:9 | |
| Red Hat | Red Hat OpenShift Container Platform 4 | - | cpe:/a:redhat:openshift:4 |
II. Public POCs for CVE-2025-8283
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-8283
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same weakness: CWE-15
- CVE-2026-43531
OpenClaw < 2026.4.9 - Environment Variable Injection via Wor - CVE-2026-41384
OpenClaw < 2026.3.24 - Environment Variable Injection via Wo - CVE-2026-41294
OpenClaw < 2026.3.28 - Environment Variable Injection via CW - CVE-2026-0232
Cortex XDR Agent: Local Administrator can disable the agent - CVE-2026-35650
OpenClaw < 2026.3.22 - Environment Variable Override Bypass
V. Comments for CVE-2025-8283
No comments yet