PT-2021-7849 · Podman+7 · Podman+7
Published
2021-11-12
·
Updated
2025-02-08
·
CVE-2021-4024
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
podman (affected versions not specified)
Description
A flaw was found in podman. The
podman machine function spawns a gvproxy process on the host system. The gvproxy API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the gvproxy API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Origin Validation Error
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Red Hat
Red Os
Rocky Linux
Suse
Podman