PT-2019-5382 · Red Hat+4 · Podman+5

Published 2019-10-28 · Updated 2024-08-20 · CVE-2019-18466

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Podman versions prior to 1.6.0

Description The issue is related to the handling of symbolic links in the libpod library of Podman. It allows an attacker to create a container image with specific symlinks that, when copied to the host filesystem by a victim user, may overwrite existing files with other files from the host. This could potentially lead to unauthorized modifications of the host system.

Recommendations For versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the copy operation from the container to the host to minimize the risk of exploitation. Avoid using Podman to copy files from containers to the host filesystem until the issue is resolved.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

ALSA-2019:4269

BDU:2020-02713

CESA-2019_4269

CVE-2019-18466

GHSA-R34V-GQMW-QVGJ

GO-2023-1942

OPENSUSE-SU-2020:0398-1

OPENSUSE-SU-2020_0398-1

RHSA-2019:4269

RHSA-2019_4269

RHSA-2020:1227

RLSA-2019:4269

SUSE-SU-2020:0697-1

SUSE-SU-2020_0697-1

Affected Products

Almalinux

Centos

Podman

Red Hat

Rocky Linux

Suse

References · 36

• 🔥 https://github.com/containers/libpod/issues/3829 · Exploit
• https://github.com/containers/libpod/commit/5c09c4d2947a759724f9d5aef6bac04317e03f7e · Patch
• https://github.com/containers/libpod/compare/v1.5.1...v1.6.0 · Patch
• https://access.redhat.com/errata/RHSA-2019:4269 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0398-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00040.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2019:4269 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18466 · Security Note
• https://osv.dev/vulnerability/GO-2023-1942 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02713 · Security Note
• https://osv.dev/vulnerability/RLSA-2019:4269 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0697-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r34v-gqmw-qvgj · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2019-4269.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2019:4269 · Vendor Advisory