id: GO-2022-1159
modules:
    - module: github.com/containers/podman/v4
      versions:
        - introduced: 4.1.0-rc1
      vulnerable_at: 4.3.1
      packages:
        - package: github.com/containers/podman/v4/pkg/bindings/images
          symbols:
            - Build
            - nTar
summary: Path traversal in github.com/containers/podman/v4
description: |-
    The local path and the lowest subdirectory may be disclosed due to incorrect
    absolute path traversal, resulting in an impact to confidentiality.
cves:
    - CVE-2022-4123
ghsas:
    - GHSA-rprg-4v7q-87v7
credits:
    - Sage McTaggart
references:
    - report: https://bugzilla.redhat.com/show_bug.cgi?id=2144989
    - web: https://github.com/containers/podman/pull/13531