GitHub Advisoryadvisory · Go

GHSA-rh5f-2w6r-q7vj Podman Path Traversal Vulnerability leads to arbitrary file read/write

HIGH Published 2022-05-24 Modified 2023-08-25 Official page ↗
Aliases
CVE-2019-10152
Ecosystem
Go
Packages
github.com/containers/podman
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-22, CWE-59
Reviewed
2023-07-14

Affected packages

• Go github.com/containers/podman: < 1.4.0 → fixed in 1.4.0

Description

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.

Related

Alias · CVE (1)

  • CVE-2019-10152 A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-59 Improper Link Resolution Before File Access weakness

References