High severity · published Jul 30, 2019
CVE-2019-10152
A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Leap · Opensuse
15.1 · source: NVD
LI
Libpod · Libpod Project
before 1.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10152
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10152
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152
Release Notes
https://github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140
Third Party Advisory
https://github.com/containers/libpod/issues/3211
Third Party Advisory
https://github.com/containers/libpod/pull/3214
More from Libpod
8.8
CVE-2018-10856
It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user
5.9
CVE-2020-1726
A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only
5.9
CVE-2019-10214
The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not…
5.5
CVE-2019-18466
An issue was discovered in Podman in libpod before 1.6.0