Podman Path Traversal Vulnerability leads to arbitrary file read/write

Also known as GHSA-rh5f-2w6r-q7vj, GO-2023-1927

Published 7 y ago 2019-07-30 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.0 · CNA

CISA KEV

not known exploited

EPSS

0.5%

percentile 41%

Public exploits

none known

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.

Exploit prediction (EPSS)

0.47% probability of exploitation in the next 30 days, higher than 41% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	7.5	`CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H`
NVD	3.1	7.2	`CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N`
CNA	3.0	7.5	`CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H`
NVD	2.0	2.6	`AV:L/AC:H/Au:N/C:P/I:P/A:N`
GitHub	3.1	7.2	`CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/containers/podman`	<1.4.0	1.4.0

Affected products

Podman podman

Classification

Weakness

CWE-59 Improper Link Resolution Before File Access
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-10152 · x_refsource_CONFIRM, x_transferred
github.com /containers/libpod/issues/3211 · x_refsource_CONFIRM, x_transferred
github.com /containers/libpod/pull/3214 · x_refsource_CONFIRM, x_transferred
github.com /containers/libpod/blob/master/RELEASE_NOTES.md#140 · x_refsource_CONFIRM, x_transferred
lists.opensuse.org /opensuse-security-announce/2019-09/msg00001.html · vendor-advisory, x_refsource_SUSE, x_transferred
nvd.nist.gov /vuln/detail/CVE-2019-10152 · advisory
github.com /containers/libpod · package
github.com /advisories/GHSA-rh5f-2w6r-q7vj · advisory

Sources

CVE List: CVE-2019-10152
GitHub Advisory: GHSA-rh5f-2w6r-q7vj
NVD: CVE-2019-10152
OSV: GO-2023-1927

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary