A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-criuUpgrade critUpgrade python-podman-apiUpgrade slirp4netnsUpgrade criuUpgrade toolboxUpgrade udica | May 13, 2022 | Feb 11, 2020 |
| Alpine Linux | — | Upgrade podman | Aug 22, 2024 | Feb 11, 2020 |
| Centos_linux | — | Upgrade containernetworking-pluginsUpgrade criu-debugsourceUpgrade runcUpgrade slirp4netns-debugsourceUpgrade runc-debugsourceUpgrade python3-criuUpgrade runc-debuginfoUpgrade criu-debuginfoUpgrade containers-commonUpgrade critUpgrade fuse-overlayfs-debugsourceUpgrade container-selinuxUpgrade podman-remote-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-remoteUpgrade podmanUpgrade buildah-debuginfoUpgrade skopeoUpgrade podman-debuginfoUpgrade skopeo-testsUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-debugsourceUpgrade podman-testsUpgrade toolboxUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debuginfoUpgrade criuUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade conmonUpgrade podman-dockerUpgrade buildahUpgrade skopeo-debuginfoUpgrade udicaUpgrade slirp4netnsUpgrade python-podman-apiUpgrade podman-debugsourceUpgrade cockpit-podman | Apr 29, 2020 | Feb 11, 2020 |
| Debian | — | Upgrade libpod | Jul 30, 2024 | Feb 11, 2020 |
| Oracle_linux | — | Upgrade udicaUpgrade critUpgrade python-podman-apiUpgrade runcUpgrade container-selinuxUpgrade containernetworking-pluginsUpgrade buildah-testsUpgrade buildahUpgrade python3-criuUpgrade cockpit-podmanUpgrade podman-remoteUpgrade containers-commonUpgrade fuse-overlayfsUpgrade slirp4netnsUpgrade podman-dockerUpgrade podmanUpgrade skopeo-testsUpgrade skopeoUpgrade criuUpgrade podman-testsUpgrade conmon | Jul 22, 2024 | Feb 11, 2020 |
| Redhat Openshift | — | Upgrade podman | Mar 12, 2020 | Feb 11, 2020 |
| Redhat_linux | — | Upgrade slirp4netns-debugsourceUpgrade containers-commonUpgrade containernetworking-plugins-debugsourceUpgrade podman-remoteUpgrade container-selinuxUpgrade containernetworking-pluginsUpgrade conmonUpgrade podman-debugsourceUpgrade skopeoUpgrade slirp4netns-debuginfoUpgrade toolboxUpgrade fuse-overlayfs-debuginfoUpgrade critUpgrade containernetworking-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade runc-debuginfoUpgrade buildah-debugsourceUpgrade skopeo-testsUpgrade runcUpgrade podmanUpgrade criuUpgrade skopeo-debugsourceUpgrade slirp4netnsUpgrade podman-dockerUpgrade cockpit-podmanUpgrade buildah-debuginfoUpgrade skopeo-debuginfoUpgrade runc-debugsourceUpgrade buildah-tests-debuginfoUpgrade criu-debuginfoUpgrade podman-testsUpgrade python3-criuUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade criu-debugsourceUpgrade udicaUpgrade buildahUpgrade python-podman-apiUpgrade fuse-overlayfs-debugsourceUpgrade podman-debuginfo | Apr 29, 2020 | Feb 11, 2020 |
| Rocky_linux | — | Upgrade python3-criuUpgrade slirp4netns-debuginfoUpgrade slirp4netns-debugsourceUpgrade critUpgrade runc-debuginfoUpgrade runcUpgrade runc-debugsourceUpgrade slirp4netnsUpgrade criu-debugsourceUpgrade criuUpgrade criu-debuginfo | Mar 12, 2024 | Feb 11, 2020 |
| Suse | — | Upgrade fuse-overlayfsUpgrade podman-remoteUpgrade podman-cni-configUpgrade libcontainers-commonUpgrade podmanUpgrade podman-dockerUpgrade conmon | Sep 29, 2020 | Feb 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub