High severity · published Jun 9, 2022
CVE-2019-25067
A vulnerability, which was classified as critical, was found in Podman and Varlink 1.5.1
8.8
CVSS
2.6%
EPSS
No
On KEV
Description
A vulnerability, which was classified as critical, was found in Podman and Varlink 1.5.1. This affects an unknown part of the component API. The manipulation leads to Remote Privilege Escalation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-143949 was assigned to this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Podman · Podman Project
1.5.1 · source: NVD
VA
Varlink · Varlink
1.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-25067
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-25067
github.com
https://github.com/containers/podman/issues/21628
vuldb.com
https://vuldb.com/?ctiid.143949
Third Party Advisory
https://vuldb.com/?id.143949
Exploit
https://www.exploit-db.com/exploits/47500
More from Podman
8.8
CVE-2022-1227
A privilege escalation flaw was found in Podman
7.8
CVE-2026-33414
PowerShell Command Injection in Podman HyperV Machine
7.7
CVE-2024-3056
A flaw was found in Podman
7.5
CVE-2026-57231
Podman: Malformed Image can trick podman run into leaking host environment variables into the container
7.5
CVE-2022-2738
The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-8945,…