CVE-2019-10152 Podman Path Traversal Vulnerability leads to arbitrary file read/write
HighCVSS 7.2
EPSS 0.47%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| containers github.com/containers/podman/v4(Go) | < 1.4.0 | 1.4.0 |
| libpod project libpod | < 1.4.0 | 1.4.0 |
| openSUSE leap | = 15.1 | No fix listed |
| podman | = fixed in 1.4.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com third-party-advisory
- github.com patch third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- github.com release-notes third-party-advisory
- openSUSE-SU-2019:2044 mailing-list third-party-advisory vendor-advisory
- github.com vendor-advisory
- github.com product
- Debian Security Tracker CVE-2019-10152 vendor-advisory