A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade toolboxUpgrade udicaUpgrade criuUpgrade critUpgrade slirp4netnsUpgrade python3-criuUpgrade python-podman-api | May 13, 2022 | Feb 11, 2020 |
| Alpine Linux | — | Upgrade podman | Aug 22, 2024 | Feb 11, 2020 |
| Centos_linux | — | Upgrade conmonUpgrade buildah-testsUpgrade slirp4netns-debuginfoUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade containernetworking-plugins-debugsourceUpgrade buildahUpgrade cockpit-podmanUpgrade skopeo-debuginfoUpgrade podman-debugsourceUpgrade python-podman-apiUpgrade slirp4netnsUpgrade podman-testsUpgrade udicaUpgrade toolboxUpgrade containernetworking-plugins-debuginfoUpgrade criuUpgrade skopeo-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfoUpgrade runcUpgrade containers-commonUpgrade podman-remoteUpgrade slirp4netns-debugsourceUpgrade criu-debugsourceUpgrade skopeoUpgrade python3-criuUpgrade critUpgrade container-selinuxUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade skopeo-testsUpgrade podman-debuginfoUpgrade buildah-debugsourceUpgrade podmanUpgrade runc-debuginfoUpgrade runc-debugsourceUpgrade podman-remote-debuginfoUpgrade criu-debuginfoUpgrade containernetworking-plugins | Apr 29, 2020 | Feb 11, 2020 |
| Debian | — | Upgrade libpod | Jul 30, 2024 | Feb 11, 2020 |
| Oracle_linux | — | Upgrade conmonUpgrade podman-testsUpgrade podman-dockerUpgrade skopeoUpgrade slirp4netnsUpgrade podmanUpgrade skopeo-testsUpgrade fuse-overlayfsUpgrade criuUpgrade python-podman-apiUpgrade cockpit-podmanUpgrade buildahUpgrade udicaUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade containers-commonUpgrade python3-criuUpgrade buildah-testsUpgrade runcUpgrade critUpgrade container-selinux | Jul 22, 2024 | Feb 11, 2020 |
| Redhat Openshift | — | Upgrade podman | Mar 12, 2020 | Feb 11, 2020 |
| Redhat_linux | — | Upgrade podman-dockerUpgrade runc-debugsourceUpgrade skopeo-debuginfoUpgrade criuUpgrade skopeo-debugsourceUpgrade buildah-tests-debuginfoUpgrade buildah-debuginfoUpgrade podman-debuginfoUpgrade podman-testsUpgrade cockpit-podmanUpgrade udicaUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfsUpgrade criu-debugsourceUpgrade python3-criuUpgrade python-podman-apiUpgrade criu-debuginfoUpgrade buildahUpgrade slirp4netnsUpgrade buildah-testsUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade skopeo-testsUpgrade slirp4netns-debugsourceUpgrade critUpgrade podmanUpgrade runc-debuginfoUpgrade toolboxUpgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade podman-remoteUpgrade container-selinuxUpgrade runcUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-remote-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-debugsourceUpgrade conmon | Apr 29, 2020 | Feb 11, 2020 |
| Rocky_linux | — | Upgrade slirp4netnsUpgrade criuUpgrade criu-debuginfoUpgrade runc-debugsourceUpgrade criu-debugsourceUpgrade slirp4netns-debugsourceUpgrade python3-criuUpgrade runc-debuginfoUpgrade critUpgrade slirp4netns-debuginfoUpgrade runc | Mar 12, 2024 | Feb 11, 2020 |
| Suse | — | Upgrade conmonUpgrade libcontainers-commonUpgrade podman-remoteUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade podman-cni-configUpgrade podman | Sep 29, 2020 | Feb 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub