A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade udicaUpgrade criuUpgrade toolboxUpgrade slirp4netnsUpgrade python-podman-apiUpgrade critUpgrade python3-criu | May 13, 2022 | Feb 11, 2020 |
| Alpine Linux | — | Upgrade podman | Aug 22, 2024 | Feb 11, 2020 |
| Centos_linux | — | Upgrade python-podman-apiUpgrade cockpit-podmanUpgrade containernetworking-plugins-debuginfoUpgrade criuUpgrade toolboxUpgrade skopeo-debugsourceUpgrade buildahUpgrade buildah-testsUpgrade skopeo-debuginfoUpgrade conmonUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netnsUpgrade udicaUpgrade podman-debugsourceUpgrade podman-testsUpgrade criu-debuginfoUpgrade slirp4netns-debugsourceUpgrade containers-commonUpgrade runcUpgrade skopeoUpgrade python3-criuUpgrade critUpgrade runc-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade skopeo-testsUpgrade podman-debuginfoUpgrade buildah-debuginfoUpgrade podman-remoteUpgrade buildah-tests-debuginfoUpgrade container-selinuxUpgrade buildah-debugsourceUpgrade podmanUpgrade runc-debugsourceUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade containernetworking-pluginsUpgrade criu-debugsource | Apr 29, 2020 | Feb 11, 2020 |
| Debian | — | Upgrade libpod | Jul 30, 2024 | Feb 11, 2020 |
| Oracle_linux | — | Upgrade container-selinuxUpgrade critUpgrade udicaUpgrade podman-remoteUpgrade buildah-testsUpgrade cockpit-podmanUpgrade python3-criuUpgrade runcUpgrade containers-commonUpgrade python-podman-apiUpgrade buildahUpgrade containernetworking-pluginsUpgrade slirp4netnsUpgrade podmanUpgrade podman-testsUpgrade skopeoUpgrade skopeo-testsUpgrade conmonUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade criu | Jul 22, 2024 | Feb 11, 2020 |
| Redhat Openshift | — | Upgrade podman | Mar 12, 2020 | Feb 11, 2020 |
| Redhat_linux | — | Upgrade containernetworking-plugins-debugsourceUpgrade skopeo-testsUpgrade toolboxUpgrade critUpgrade fuse-overlayfs-debuginfoUpgrade runcUpgrade containers-commonUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade conmonUpgrade podman-remote-debuginfoUpgrade skopeoUpgrade podman-remoteUpgrade runc-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-debugsourceUpgrade buildah-debugsourceUpgrade containernetworking-pluginsUpgrade podmanUpgrade container-selinuxUpgrade criu-debuginfoUpgrade buildahUpgrade python-podman-apiUpgrade runc-debugsourceUpgrade criuUpgrade skopeo-debuginfoUpgrade fuse-overlayfsUpgrade skopeo-debugsourceUpgrade podman-testsUpgrade buildah-testsUpgrade slirp4netnsUpgrade criu-debugsourceUpgrade udicaUpgrade podman-dockerUpgrade podman-debuginfoUpgrade cockpit-podmanUpgrade python3-criuUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debuginfoUpgrade buildah-tests-debuginfo | Apr 29, 2020 | Feb 11, 2020 |
| Rocky_linux | — | Upgrade criu-debugsourceUpgrade slirp4netnsUpgrade criuUpgrade runc-debugsourceUpgrade criu-debuginfoUpgrade slirp4netns-debugsourceUpgrade python3-criuUpgrade slirp4netns-debuginfoUpgrade runcUpgrade runc-debuginfoUpgrade crit | Mar 12, 2024 | Feb 11, 2020 |
| Suse | — | Upgrade conmonUpgrade podmanUpgrade podman-cni-configUpgrade podman-remoteUpgrade libcontainers-commonUpgrade podman-dockerUpgrade fuse-overlayfs | Sep 29, 2020 | Feb 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub