PT-2020-14915 · Red Hat+4 · Podman+5

Riccardo Schirone + 1 · Published 2020-02-11 · Updated 2024-08-20 · CVE-2020-1726

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Podman versions 1.6.0 and later

Description A flaw was discovered in Podman where it incorrectly allows containers to overwrite existing files in volumes, even if they are mounted as read-only. This issue can be triggered when a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, allowing the overwrite of files in the volume.

Recommendations For Podman versions 1.6.0 and later, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

ALSA-2020:1650

CESA-2020_1650

CVE-2020-1726

GHSA-VMHJ-P9HW-VGRF

GO-2023-1544

OPENSUSE-SU-2020:1552-1

OPENSUSE-SU-2020:1559-1

OPENSUSE-SU-2020_1552-1

OPENSUSE-SU-2020_1559-1

OPENSUSE-SU-2024:11177-1

RHSA-2020:0680

RHSA-2020:1650

RHSA-2020_1650

RLSA-2020:1650

SUSE-SU-2020:2731-1

SUSE-SU-2020_2731-1

Affected Products

Almalinux

Centos

Podman

Red Hat

Rocky Linux

Suse

References · 88

• https://osv.dev/vulnerability/openSUSE-SU-2024:11177-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00103.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1726 · Patch
• https://osv.dev/vulnerability/RLSA-2020:1650 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1552-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vmhj-p9hw-vgrf · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0680 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-1726 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2020:1650 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00097.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-1650.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-1726 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1726 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1726 · Security Note
• https://osv.dev/vulnerability/ALSA-2020:1650 · Vendor Advisory