A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade toolboxUpgrade criuUpgrade udicaUpgrade critUpgrade python-podman-apiUpgrade slirp4netnsUpgrade python3-criu | May 13, 2022 | Feb 11, 2020 |
| Alpine Linux | — | Upgrade podman | Aug 22, 2024 | Feb 11, 2020 |
| Centos_linux | — | Upgrade critUpgrade python3-criuUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debugsourceUpgrade podmanUpgrade skopeo-testsUpgrade podman-debuginfoUpgrade containers-commonUpgrade criu-debuginfoUpgrade runcUpgrade skopeoUpgrade container-selinuxUpgrade slirp4netns-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade runc-debugsourceUpgrade runc-debuginfoUpgrade podman-remoteUpgrade buildah-tests-debuginfoUpgrade podman-remote-debuginfoUpgrade containernetworking-pluginsUpgrade buildah-debuginfoUpgrade criu-debugsourceUpgrade slirp4netnsUpgrade podman-dockerUpgrade criuUpgrade cockpit-podmanUpgrade udicaUpgrade podman-testsUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-debuginfoUpgrade buildahUpgrade fuse-overlayfsUpgrade conmonUpgrade buildah-testsUpgrade python-podman-apiUpgrade podman-debugsourceUpgrade toolboxUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debuginfoUpgrade skopeo-debugsource | Apr 29, 2020 | Feb 11, 2020 |
| Debian | — | Upgrade libpod | Jul 30, 2024 | Feb 11, 2020 |
| Oracle_linux | — | Upgrade podmanUpgrade fuse-overlayfsUpgrade skopeoUpgrade criuUpgrade skopeo-testsUpgrade conmonUpgrade podman-testsUpgrade slirp4netnsUpgrade podman-dockerUpgrade python-podman-apiUpgrade runcUpgrade cockpit-podmanUpgrade containers-commonUpgrade buildahUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade critUpgrade udicaUpgrade python3-criuUpgrade container-selinuxUpgrade buildah-tests | Jul 22, 2024 | Feb 11, 2020 |
| Redhat Openshift | — | Upgrade podman | Mar 12, 2020 | Feb 11, 2020 |
| Redhat_linux | — | Upgrade criu-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade python3-criuUpgrade python-podman-apiUpgrade runc-debugsourceUpgrade criuUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfsUpgrade criu-debuginfoUpgrade buildah-testsUpgrade skopeo-debuginfoUpgrade skopeo-debugsourceUpgrade podman-testsUpgrade buildahUpgrade slirp4netnsUpgrade buildah-debuginfoUpgrade podman-dockerUpgrade podman-debuginfoUpgrade cockpit-podmanUpgrade udicaUpgrade podman-remote-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade container-selinuxUpgrade skopeoUpgrade buildah-debugsourceUpgrade podman-debugsourceUpgrade containernetworking-pluginsUpgrade conmonUpgrade containernetworking-plugins-debuginfoUpgrade skopeo-testsUpgrade toolboxUpgrade fuse-overlayfs-debuginfoUpgrade containers-commonUpgrade critUpgrade runc-debuginfoUpgrade runcUpgrade podman-remoteUpgrade slirp4netns-debuginfoUpgrade podmanUpgrade slirp4netns-debugsource | Apr 29, 2020 | Feb 11, 2020 |
| Rocky_linux | — | Upgrade python3-criuUpgrade runc-debuginfoUpgrade runcUpgrade slirp4netns-debugsourceUpgrade slirp4netns-debuginfoUpgrade critUpgrade criuUpgrade slirp4netnsUpgrade criu-debugsourceUpgrade runc-debugsourceUpgrade criu-debuginfo | Mar 12, 2024 | Feb 11, 2020 |
| Suse | — | Upgrade libcontainers-commonUpgrade podman-dockerUpgrade fuse-overlayfsUpgrade podman-cni-configUpgrade podmanUpgrade podman-remoteUpgrade conmon | Sep 29, 2020 | Feb 11, 2020 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub