CVE-2019-18466: Improper Link Resolution Before File Access

An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a...

PT-2019-5382 · Red Hat +4 · Podman +5

Name of the Vulnerable Software and Affected Versions: Podman versions prior to 1.6.0 Description: The issue is related to the handling of symbolic links in the libpod library of Podman. It allows an attacker to create a container image with specific symlinks that, when copied to the host...

Podman / Varlink Remote Code Execution

!/usr/bin/python -- coding: UTF-8 -- pickletime.py Podman + Varlink Insecure Config Remote Exploit Jeremy Brown jbrown3264/gmail @ Oct 2019 ------- Details ------- Podman is container engine / platform similar to Docker supported by RedHat and Fedora with Varlink being a protocol to exchange...

Podman & Varlink 1.5.1 - Remote Code Execution Exploit

Exploit Title: Podman & Varlink 1.5.1 - Remote Code Execution Exploit Author: Jeremy Brown Date: 2019-10-15 Vendor Homepage: https://podman.io/ Software Link: dnf install podman or https://github.com/containers/libpod/releases Version: 1.5.1 Tested on: Fedora Server 30 !/usr/bin/python -- coding:...

Podman Varlink 1.5.1 - Remote Code Execution

Podman Varlink 1.5.1 - Remote Code Execution Exploit Title: Podman & Varlink 1.5.1 - Remote Code Execution Exploit Author: Jeremy Brown Date: 2019-10-15 Vendor Homepage: https://podman.io/ Software Link: dnf install podman or https://github.com/containers/libpod/releases Version: 1.5.1 Tested on:...

Podman & Varlink 1.5.1 - Remote Code Execution

Exploit Title: Podman & Varlink 1.5.1 - Remote Code Execution Exploit Author: Jeremy Brown Date: 2019-10-15 Vendor Homepage: https://podman.io/ Software Link: dnf install podman or https://github.com/containers/libpod/releases Version: 1.5.1 Tested on: Fedora Server 30 !/usr/bin/python -- coding:...

containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launc...

CVE-2019-10152

A path traversal vulnerability has been discovered in podman in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container...

containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launc...

openSUSE Security Update : podman (openSUSE-2019-2143)

This update for podman fixes the following issues : Security issue fixed : - CVE-2019-10214: Fixed missing enforcement of TLS connections. bsc1144065 This update was imported from the SUSE:SLE-15-SP1:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks i...

OPENSUSE-SU-2019:2143-1 Security update for podman

This update for podman fixes the following issues: Security issue fixed: - CVE-2019-10214: Fixed missing enforcement of TLS connections. bsc1144065 This update was imported from the SUSE:SLE-15-SP1:Update update project...

Security update for podman (moderate)

openSUSE Security Update: Security update for podman Announcement ID: openSUSE-SU-2019:2143-1 Rating: moderate References: 1144065 Cross-References: CVE-2019-10214 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for podman...

SUSE SLES15 Security Update : podman (SUSE-SU-2019:2346-1)

This update for podman fixes the following issues : Security issue fixed : CVE-2019-10214: Fixed missing enforcement of TLS connections. bsc1144065 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

container-tools:rhel8 bug fix update

Bug Fixes: race/corruption: podman failed to launch containers BZ1741110 podman exec can fail with "failed to write ... to cgroup.procs invalid argument" BZ1743163...

ALBA-2019:2723 container-tools:rhel8 bug fix update

Bug Fixes: race/corruption: podman failed to launch containers BZ1741110 podman exec can fail with "failed to write ... to cgroup.procs invalid argument" BZ1743163...

SUSE-SU-2019:2346-1 Security update for podman

This update for podman fixes the following issues: Security issue fixed: - CVE-2019-10214: Fixed missing enforcement of TLS connections. bsc1144065...

openSUSE Security Update : podman / slirp4netns and libcontainers-common (openSUSE-2019-2044)

This is a version update for podman to version 1.4.4 bsc1143386. Additional changes by SUSE on top : - Remove fuse-overlayfs because it's currently an unsatisfied dependency on SLE bsc1143386 - Update libpod.conf to use correct infracommand - Update libpod.conf to use better versioned pause...

OPENSUSE-SU-2019:2044-1 Security update for podman, slirp4netns and libcontainers-common

This is a version update for podman to version 1.4.4 bsc1143386. Additional changes by SUSE on top: - Remove fuse-overlayfs because it's currently an unsatisfied dependency on SLE bsc1143386 - Update libpod.conf to use correct infracommand - Update libpod.conf to use better versioned pause...

Security update for podman, slirp4netns and libcontainers-common (moderate)

openSUSE Security Update: Security update for podman, slirp4netns and libcontainers-common Announcement ID: openSUSE-SU-2019:2044-1 Rating: moderate References: 1096726 1123156 1123387 1135460 1136974 1137860 1143386 Cross-References: CVE-2018-15664 CVE-2019-10152 CVE-2019-6778 Affected Products:...

SUSE SLES15 Security Update : podman, slirp4netns / libcontainers-common (SUSE-SU-2019:2223-1)

This is a version update for podman to version 1.4.4 bsc1143386. Additional changes by SUSE on top : Remove fuse-overlayfs because it's currently an unsatisfied dependency on SLE bsc1143386 Update libpod.conf to use correct infracommand Update libpod.conf to use better versioned pause container...