An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a victim user to the host filesystem, may overwrite existing files with others from the host.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-systemd-hookUpgrade oci-umount | May 13, 2022 | Oct 28, 2019 |
| Centos_linux | — | Upgrade buildah-testsUpgrade toolboxUpgrade cockpit-podmanUpgrade podman-manpagesUpgrade skopeo-debugsourceUpgrade slirp4netns-debugsourceUpgrade fuse-overlayfsUpgrade containernetworking-plugins-debuginfoUpgrade oci-systemd-hook-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade python-podman-apiUpgrade podman-dockerUpgrade podman-testsUpgrade podman-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade oci-umount-debuginfoUpgrade slirp4netnsUpgrade skopeo-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade buildahUpgrade slirp4netns-debuginfoUpgrade runcUpgrade oci-systemd-hookUpgrade container-selinuxUpgrade skopeo-testsUpgrade oci-umountUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade containernetworking-pluginsUpgrade runc-debugsourceUpgrade oci-umount-debugsourceUpgrade podmanUpgrade buildah-debugsourceUpgrade buildah-debuginfoUpgrade podman-remote-debuginfoUpgrade containers-commonUpgrade podman-debuginfoUpgrade skopeoUpgrade runc-debuginfoUpgrade podman-remote | Jan 20, 2020 | Oct 28, 2019 |
| Redhat_linux | — | Upgrade fuse-overlayfs-debugsourceUpgrade containers-commonUpgrade python-podman-apiUpgrade buildah-debuginfoUpgrade toolboxUpgrade buildahUpgrade podmanUpgrade buildah-tests-debuginfoUpgrade buildah-testsUpgrade oci-umount-debuginfoUpgrade skopeo-debugsourceUpgrade fuse-overlayfsUpgrade skopeoUpgrade oci-umountUpgrade podman-remote-debuginfoUpgrade runc-debugsourceUpgrade cockpit-podmanUpgrade fuse-overlayfs-debuginfoUpgrade slirp4netns-debuginfoUpgrade container-selinuxUpgrade slirp4netnsUpgrade skopeo-testsUpgrade runcUpgrade buildah-debugsourceUpgrade podman-debuginfoUpgrade podman-dockerUpgrade oci-umount-debugsourceUpgrade skopeo-debuginfoUpgrade oci-systemd-hook-debuginfoUpgrade podman-manpagesUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade podman-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade runc-debuginfoUpgrade containernetworking-pluginsUpgrade oci-systemd-hookUpgrade containernetworking-plugins-debuginfoUpgrade podman-remoteUpgrade podman-tests | Jan 20, 2020 | Oct 28, 2019 |
| Rocky_linux | — | Upgrade oci-systemd-hook-debuginfoUpgrade oci-systemd-hookUpgrade oci-umount-debugsourceUpgrade oci-umountUpgrade oci-umount-debuginfoUpgrade oci-systemd-hook-debugsource | Mar 12, 2024 | Oct 28, 2019 |
| Suse | — | Upgrade conmonUpgrade podmanUpgrade fuse-overlayfsUpgrade podman-cni-configUpgrade cni-pluginsUpgrade cni | Mar 31, 2020 | Oct 28, 2019 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub