Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
redhatRedHatRHSA-2020:5056
HistoryNov 10, 2020 - 1:33 p.m.

(RHSA-2020:5056) Moderate: podman security and bug fix update

2020-11-1013:33:51
access.redhat.com
108

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

49.2%

JSON

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)

  • podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API (CVE-2020-14370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • podman does not use $TMPDIR loading a tar file (BZ#1877699)

Related

nessus 30
oraclelinux 3
fedora 10
openvas 15
altlinux 1
cve 3
archlinux 1
prion 3
suse 3
ubuntucve 2
redhatcve 3
rocky 2
veracode 3
debiancve 2
osv 10
almalinux 2
redhat 30
alpinelinux 1
github 2
wolfi 1
ibm 15
gitlab 2
cgr 1
amazon 2
ubuntu 1
nessus
nessus
RHEL 7 : podman (RHSA-2020:5056)
2020-11-11 00:00:00
openSUSE Security Update : podman (openSUSE-2020-2039)
2020-11-30 00:00:00
Fedora 32 : 2:podman / crun (2020-76fcd0ba34)
2020-10-05 00:00:00
oraclelinux
oraclelinux
container-tools:ol8 security, bug fix, and enhancement update
2021-02-20 00:00:00
go-toolset:ol8 security update
2020-09-11 00:00:00
container-tools:ol8 security, bug fix, and enhancement update
2020-11-10 00:00:00
fedora
fedora
[SECURITY] Fedora 33 Update: podman-2.1.1-10.fc33
2020-10-06 00:16:49
[SECURITY] Fedora 33 Update: skopeo-1.2.0-3.fc33
2020-10-06 00:16:49
[SECURITY] Fedora 31 Update: podman-2.1.1-3.fc31
2020-10-09 15:01:15
openvas
openvas
Fedora: Security Advisory for crun (FEDORA-2020-76fcd0ba34)
2020-10-02 00:00:00
Fedora: Security Advisory for skopeo (FEDORA-2020-7b6058fec9)
2020-10-06 00:00:00
Fedora: Security Advisory for podman (FEDORA-2020-7b6058fec9)
2020-10-06 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 10 package podman version 2.1.1-alt1
2020-11-10 00:00:00
cve
cve
CVE-2020-14370
2020-09-23 13:15:00
CVE-2020-14040
2020-06-17 20:15:00
CVE-2022-2739
2022-09-01 21:15:00
archlinux
archlinux
[ASA-202009-11] podman: information disclosure
2020-09-26 00:00:00
prion
prion
Information disclosure
2020-09-23 13:15:00
Design/Logic Flaw
2020-06-17 20:15:00
Design/Logic Flaw
2022-09-01 21:15:00
suse
suse
Security update for podman (moderate)
2020-11-26 00:00:00
Security update for podman (moderate)
2020-11-27 00:00:00
Security update for conmon, libcontainers-common, libseccomp, podman (moderate)
2022-03-04 00:00:00
ubuntucve
ubuntucve
CVE-2020-14370
2020-09-23 00:00:00
CVE-2020-14040
2020-06-17 00:00:00
redhatcve
redhatcve
CVE-2020-14370
2020-09-22 09:02:43
CVE-2020-14040
2021-06-27 12:24:34
CVE-2022-2739
2022-08-19 08:38:34
rocky
rocky
container-tools:rhel8 security, bug fix, and enhancement update
2021-02-16 07:31:27
container-tools:rhel8 security, bug fix, and enhancement update
2020-11-03 12:27:37
veracode
veracode
Information Disclosure
2020-10-28 11:04:33
Denial Of Service (DoS)
2020-06-17 03:55:36
Information Disclosure
2022-09-05 21:42:42
debiancve
debiancve
CVE-2020-14370
2020-09-23 13:15:00
CVE-2020-14040
2020-06-17 20:15:00
osv
osv
Information disclosure in podman
2024-04-24 21:42:22
Moderate: container-tools:rhel8 security, bug fix, and enhancement update
2021-02-16 07:31:27
CVE-2020-14370
2020-09-23 13:15:15
almalinux
almalinux
Moderate: container-tools:rhel8 security, bug fix, and enhancement update
2021-02-16 07:31:27
Moderate: container-tools:rhel8 security, bug fix, and enhancement update
2020-11-03 12:27:37
redhat
redhat
(RHSA-2021:0531) Moderate: container-tools:rhel8 security, bug fix, and enhancement update
2021-02-16 07:31:27
(RHSA-2020:3780) Moderate: OpenShift Container Platform 4.5.11 ose-cluster-svcat-apiserver-operator-container security update
2020-09-21 19:38:11
(RHSA-2020:5054) Moderate: skopeo security update
2020-11-10 13:33:26
alpinelinux
alpinelinux
CVE-2020-14370
2020-09-23 13:15:00
github
github
Information disclosure in podman
2024-04-24 21:42:22
golang.org/x/text Infinite loop
2021-05-18 18:34:35
wolfi
wolfi
CVE-2020-14040 vulnerabilities
2024-04-26 09:06:29
ibm
ibm
Security Bulletin: A vulnerabilty in encoding/unicode in the UTF-16 decoder has been found in x/text package before v0.3.3 for Go that could lead to an infinite loop and denial of service, affecting IBM Cloud Pak for Applications
2021-08-02 17:36:34
Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak
2023-10-18 16:55:45
Security Bulletin: Open Source Dependency Vulnerability
2023-05-15 17:56:50
gitlab
gitlab
Loop with Unreachable Exit Condition (Infinite Loop)
2020-06-17 00:00:00
Loop with Unreachable Exit Condition ('Infinite Loop')
2021-05-18 00:00:00
cgr
cgr
CVE-2020-14040 vulnerabilities
2024-04-26 03:19:48
amazon
amazon
Medium: golang
2020-09-28 20:57:00
Medium: golang
2020-10-26 18:04:00
ubuntu
ubuntu
Go Text vulnerabilities
2023-02-16 00:00:00

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

49.2%

JSON
Related for RHSA-2020:5056
nessus30oraclelinux3fedora10openvas15altlinux1cve3archlinux1prion3suse3ubuntucve2redhatcve3rocky2veracode3debiancve2osv10almalinux2redhat30alpinelinux1github2wolfi1ibm15gitlab2cgr1amazon2ubuntu1