Medium severity · published Feb 11, 2020
CVE-2020-1726
A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only
5.9
CVSS
1.8%
EPSS
No
On KEV
Description
A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
8.0 · source: NVD
LI
Libpod · Libpod Project
1.6.0 · source: NVD
OC
Openshift Container Platform · Redhat
4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1726
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1726
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00097.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00103.html
access.redhat.com
https://access.redhat.com/errata/RHSA-2020:0680
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1726
More from Libpod
8.8
CVE-2018-10856
It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user
7.2
CVE-2019-10152
A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers
5.9
CVE-2019-10214
The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not…
5.5
CVE-2019-18466
An issue was discovered in Podman in libpod before 1.6.0