CVE-2023-0778

🗓️ 27 Mar 2023 21:10:15Reported by redhatType

A TOCTOU flaw in podman allows symlink replacement in a volume, leading to access of arbitrary files

Reporter	Title	Published	Views	Family All 53
Veracode	Time-of-Check Time-of-Use	26 Feb 202318:27	–	veracode
ALT Linux	Security fix for the ALT Linux 10 package podman version 4.4.2-alt1	22 Mar 202300:00	–	altlinux
UbuntuCve	CVE-2023-0778	27 Mar 202300:00	–	ubuntucve
OSV	OPENSUSE-SU-2024:12771-1 podman-4.4.2-1.1 on GA media	15 Jun 202400:00	–	osv
OSV	Time-of-check time-of-use race condition in github.com/containers/podman/v4	3 Apr 202318:53	–	osv
OSV	Podman Time-of-check Time-of-use (TOCTOU) Race Condition	27 Mar 202321:30	–	osv
OSV	RHSA-2023:1325 Red Hat Security Advisory: OpenShift Container Platform 4.13.0 security update	2 Oct 202400:13	–	osv
OSV	Moderate: container-tools:rhel8 security, bug fix, and enhancement update	16 May 202300:00	–	osv
OSV	Moderate: container-tools:4.0 security and bug fix update	16 May 202300:00	–	osv
OSV	RHSA-2023:2802 Red Hat Security Advisory: container-tools:4.0 security and bug fix update	21 Oct 202418:21	–	osv

Nvd

Node

podman_project podmanMatch-

Node

redhat enterprise_linuxMatch8.0

redhat enterprise_linuxMatch9.0

[
  {
    "vendor": "n/a",
    "product": "podman",
    "versions": [
      {
        "version": "unknown",
        "status": "affected"
      }
    ]
  }
]

Source	Link
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

27 Mar 2023 21:15Current

6.8Medium risk

Vulners AI Score6.8

CVSS36.8

EPSS0.00063

SSVC

CWE-367