Veracode Vulnerability DatabaseVERACODE:20979Arbitrary File Read
7.2 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
2.6 Low
CVSS2
Access Vector
LOCAL
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:H/Au:N/C:P/I:P/A:N
podman is vulnerable to arbitrary file read. The vulnerability exists through an improper symlink resolution allows access to host files when executing podman cp on running containers.
References
lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html
access.redhat.com/errata/RHSA-2019:1907
access.redhat.com/security/updates/classification/#moderate
bugzilla.redhat.com/show_bug.cgi?id=1717919
bugzilla.redhat.com/show_bug.cgi?id=1727873
bugzilla.redhat.com/show_bug.cgi?id=1728242
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152
github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140
github.com/containers/libpod/issues/3211
github.com/containers/libpod/pull/3214
Related
7.2 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
2.6 Low
CVSS2
Access Vector
LOCAL
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:H/Au:N/C:P/I:P/A:N