A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade criuUpgrade udicaUpgrade toolboxUpgrade python-podman-apiUpgrade slirp4netnsUpgrade critUpgrade python3-criu | May 13, 2022 | Feb 11, 2020 |
| Alpine Linux | — | Upgrade podman | Aug 22, 2024 | Feb 11, 2020 |
| Centos_linux | — | Upgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade podman-debuginfoUpgrade buildah-debuginfoUpgrade criu-debugsourceUpgrade slirp4netns-debugsourceUpgrade skopeo-testsUpgrade runc-debugsourceUpgrade critUpgrade python3-criuUpgrade container-selinuxUpgrade runc-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-remoteUpgrade buildah-debugsourceUpgrade podmanUpgrade runcUpgrade containers-commonUpgrade criu-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade podman-remote-debuginfoUpgrade containernetworking-pluginsUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-debuginfoUpgrade slirp4netns-debuginfoUpgrade skopeo-debugsourceUpgrade python-podman-apiUpgrade podman-debugsourceUpgrade toolboxUpgrade containernetworking-plugins-debuginfoUpgrade cockpit-podmanUpgrade criuUpgrade podman-dockerUpgrade buildah-testsUpgrade udicaUpgrade podman-testsUpgrade buildahUpgrade fuse-overlayfsUpgrade conmonUpgrade slirp4netns | Apr 29, 2020 | Feb 11, 2020 |
| Debian | — | Upgrade libpod | Jul 30, 2024 | Feb 11, 2020 |
| Oracle_linux | — | Upgrade skopeo-testsUpgrade skopeoUpgrade fuse-overlayfsUpgrade podmanUpgrade conmonUpgrade podman-testsUpgrade slirp4netnsUpgrade podman-dockerUpgrade criuUpgrade buildahUpgrade containernetworking-pluginsUpgrade cockpit-podmanUpgrade udicaUpgrade buildah-testsUpgrade runcUpgrade python3-criuUpgrade python-podman-apiUpgrade podman-remoteUpgrade containers-commonUpgrade critUpgrade container-selinux | Jul 22, 2024 | Feb 11, 2020 |
| Redhat Openshift | — | Upgrade podman | Mar 12, 2020 | Feb 11, 2020 |
| Redhat_linux | — | Upgrade criu-debugsourceUpgrade buildahUpgrade udicaUpgrade buildah-debuginfoUpgrade slirp4netnsUpgrade python-podman-apiUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debugsourceUpgrade podman-testsUpgrade skopeo-debugsourceUpgrade python3-criuUpgrade buildah-testsUpgrade runc-debugsourceUpgrade buildah-tests-debuginfoUpgrade podman-debuginfoUpgrade criuUpgrade cockpit-podmanUpgrade podman-dockerUpgrade skopeo-debuginfoUpgrade criu-debuginfoUpgrade containers-commonUpgrade buildah-debugsourceUpgrade conmonUpgrade skopeo-testsUpgrade containernetworking-pluginsUpgrade podman-debugsourceUpgrade runcUpgrade podman-remote-debuginfoUpgrade podman-remoteUpgrade container-selinuxUpgrade critUpgrade toolboxUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade skopeoUpgrade podmanUpgrade containernetworking-plugins-debugsourceUpgrade runc-debuginfoUpgrade slirp4netns-debuginfo | Apr 29, 2020 | Feb 11, 2020 |
| Rocky_linux | — | Upgrade criu-debugsourceUpgrade slirp4netnsUpgrade criuUpgrade criu-debuginfoUpgrade runc-debugsourceUpgrade runcUpgrade python3-criuUpgrade runc-debuginfoUpgrade slirp4netns-debuginfoUpgrade slirp4netns-debugsourceUpgrade crit | Mar 12, 2024 | Feb 11, 2020 |
| Suse | — | Upgrade conmonUpgrade podman-dockerUpgrade fuse-overlayfsUpgrade podmanUpgrade podman-cni-configUpgrade podman-remoteUpgrade libcontainers-common | Sep 29, 2020 | Feb 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub