Path traversal in Podman - CVE-2019-10152
Published: September 2, 2019
Vulnerability identifier: #VU20502
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-10152
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to perform directory traversal attacks.
The vulnerability exists due to the software does not properly resolve symlinks within containers. A local authenticated attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.
Affected software
Podman
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power
Opensuse
Fedora
podman
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power
Opensuse
Fedora
podman
How to mitigate CVE-2019-10152
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
Podman - update to 1.4.0
podman - addressed in versions 1.4.0-1.fc29, 1.4.0-1.fc30, 1.4.0-2.fc29, 1.4.0-2.fc30
podman - addressed in versions 1.4.0-1.fc29, 1.4.0-1.fc30, 1.4.0-2.fc29, 1.4.0-2.fc30