csaf_opensuse - opensuse-su-2024:11177-1

opensuse-su-2024:11177-1

Vulnerability from csaf_opensuse

Published

2024-06-15 00:00

Modified

2024-06-15 00:00

Summary

podman-3.3.1-2.1 on GA media

Notes

Title of the patch

podman-3.3.1-2.1 on GA media

Description of the patch

These are all security issues fixed in the podman-3.3.1-2.1 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2024-11177

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "podman-3.3.1-2.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the podman-3.3.1-2.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-11177",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11177-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-10856 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-10856/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-10152 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-10152/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-10214 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-10214/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-14370 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-14370/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-1726 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-1726/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20199 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20199/"
      }
    ],
    "title": "podman-3.3.1-2.1 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:11177-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-3.3.1-2.1.aarch64",
                "product": {
                  "name": "podman-3.3.1-2.1.aarch64",
                  "product_id": "podman-3.3.1-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "podman-cni-config-3.3.1-2.1.aarch64",
                "product": {
                  "name": "podman-cni-config-3.3.1-2.1.aarch64",
                  "product_id": "podman-cni-config-3.3.1-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "podman-docker-3.3.1-2.1.aarch64",
                "product": {
                  "name": "podman-docker-3.3.1-2.1.aarch64",
                  "product_id": "podman-docker-3.3.1-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-3.3.1-2.1.aarch64",
                "product": {
                  "name": "podman-remote-3.3.1-2.1.aarch64",
                  "product_id": "podman-remote-3.3.1-2.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-3.3.1-2.1.ppc64le",
                "product": {
                  "name": "podman-3.3.1-2.1.ppc64le",
                  "product_id": "podman-3.3.1-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "podman-cni-config-3.3.1-2.1.ppc64le",
                "product": {
                  "name": "podman-cni-config-3.3.1-2.1.ppc64le",
                  "product_id": "podman-cni-config-3.3.1-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "podman-docker-3.3.1-2.1.ppc64le",
                "product": {
                  "name": "podman-docker-3.3.1-2.1.ppc64le",
                  "product_id": "podman-docker-3.3.1-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-3.3.1-2.1.ppc64le",
                "product": {
                  "name": "podman-remote-3.3.1-2.1.ppc64le",
                  "product_id": "podman-remote-3.3.1-2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-3.3.1-2.1.s390x",
                "product": {
                  "name": "podman-3.3.1-2.1.s390x",
                  "product_id": "podman-3.3.1-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "podman-cni-config-3.3.1-2.1.s390x",
                "product": {
                  "name": "podman-cni-config-3.3.1-2.1.s390x",
                  "product_id": "podman-cni-config-3.3.1-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "podman-docker-3.3.1-2.1.s390x",
                "product": {
                  "name": "podman-docker-3.3.1-2.1.s390x",
                  "product_id": "podman-docker-3.3.1-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-3.3.1-2.1.s390x",
                "product": {
                  "name": "podman-remote-3.3.1-2.1.s390x",
                  "product_id": "podman-remote-3.3.1-2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-3.3.1-2.1.x86_64",
                "product": {
                  "name": "podman-3.3.1-2.1.x86_64",
                  "product_id": "podman-3.3.1-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "podman-cni-config-3.3.1-2.1.x86_64",
                "product": {
                  "name": "podman-cni-config-3.3.1-2.1.x86_64",
                  "product_id": "podman-cni-config-3.3.1-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "podman-docker-3.3.1-2.1.x86_64",
                "product": {
                  "name": "podman-docker-3.3.1-2.1.x86_64",
                  "product_id": "podman-docker-3.3.1-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-3.3.1-2.1.x86_64",
                "product": {
                  "name": "podman-remote-3.3.1-2.1.x86_64",
                  "product_id": "podman-remote-3.3.1-2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-3.3.1-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64"
        },
        "product_reference": "podman-3.3.1-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-3.3.1-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le"
        },
        "product_reference": "podman-3.3.1-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-3.3.1-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x"
        },
        "product_reference": "podman-3.3.1-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-3.3.1-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64"
        },
        "product_reference": "podman-3.3.1-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-cni-config-3.3.1-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64"
        },
        "product_reference": "podman-cni-config-3.3.1-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-cni-config-3.3.1-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le"
        },
        "product_reference": "podman-cni-config-3.3.1-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-cni-config-3.3.1-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x"
        },
        "product_reference": "podman-cni-config-3.3.1-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-cni-config-3.3.1-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64"
        },
        "product_reference": "podman-cni-config-3.3.1-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-docker-3.3.1-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64"
        },
        "product_reference": "podman-docker-3.3.1-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-docker-3.3.1-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le"
        },
        "product_reference": "podman-docker-3.3.1-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-docker-3.3.1-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x"
        },
        "product_reference": "podman-docker-3.3.1-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-docker-3.3.1-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64"
        },
        "product_reference": "podman-docker-3.3.1-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-3.3.1-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64"
        },
        "product_reference": "podman-remote-3.3.1-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-3.3.1-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le"
        },
        "product_reference": "podman-remote-3.3.1-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-3.3.1-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x"
        },
        "product_reference": "podman-remote-3.3.1-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-3.3.1-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
        },
        "product_reference": "podman-remote-3.3.1-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-10856",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-10856"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-10856",
          "url": "https://www.suse.com/security/cve/CVE-2018-10856"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1097970 for CVE-2018-10856",
          "url": "https://bugzilla.suse.com/1097970"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-10856"
    },
    {
      "cve": "CVE-2019-10152",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-10152"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-10152",
          "url": "https://www.suse.com/security/cve/CVE-2019-10152"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1136974 for CVE-2019-10152",
          "url": "https://bugzilla.suse.com/1136974"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-10152"
    },
    {
      "cve": "CVE-2019-10214",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-10214"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-10214",
          "url": "https://www.suse.com/security/cve/CVE-2019-10214"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1144065 for CVE-2019-10214",
          "url": "https://bugzilla.suse.com/1144065"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-10214"
    },
    {
      "cve": "CVE-2020-14370",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-14370"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-14370",
          "url": "https://www.suse.com/security/cve/CVE-2020-14370"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1176804 for CVE-2020-14370",
          "url": "https://bugzilla.suse.com/1176804"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-14370"
    },
    {
      "cve": "CVE-2020-1726",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-1726"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-1726",
          "url": "https://www.suse.com/security/cve/CVE-2020-1726"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1164090 for CVE-2020-1726",
          "url": "https://bugzilla.suse.com/1164090"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-1726"
    },
    {
      "cve": "CVE-2021-20199",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20199"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
          "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20199",
          "url": "https://www.suse.com/security/cve/CVE-2021-20199"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1181640 for CVE-2021-20199",
          "url": "https://bugzilla.suse.com/1181640"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:podman-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-cni-config-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-docker-3.3.1-2.1.x86_64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.aarch64",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.ppc64le",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.s390x",
            "openSUSE Tumbleweed:podman-remote-3.3.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2021-20199"
    }
  ]
}

CVE-2019-10214 (GCVE-0-2019-10214)

Vulnerability from cvelistv5

Published

2019-11-25 10:41

Modified

2024-08-04 22:17

Severity ?

6.4 (Medium) - CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-522

Summary

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.

References

►

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10214	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00035.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	n/a	containers/image	Version: 3.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T22:17:18.901Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10214"
          },
          {
            "name": "openSUSE-SU-2020:0377",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00035.html"
          },
          {
            "name": "openSUSE-SU-2020:0554",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "containers/image",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-26T20:06:12",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10214"
        },
        {
          "name": "openSUSE-SU-2020:0377",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00035.html"
        },
        {
          "name": "openSUSE-SU-2020:0554",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2019-10214",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "containers/image",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "3.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "6.4/CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-522"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10214",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10214"
            },
            {
              "name": "openSUSE-SU-2020:0377",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00035.html"
            },
            {
              "name": "openSUSE-SU-2020:0554",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2019-10214",
    "datePublished": "2019-11-25T10:41:15",
    "dateReserved": "2019-03-27T00:00:00",
    "dateUpdated": "2024-08-04T22:17:18.901Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-10152 (GCVE-0-2019-10152)

Vulnerability from cvelistv5

Published

2019-07-30 22:07

Modified

2024-08-04 22:10

Severity ?

7.5 (High) - CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

CWE

Summary

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.

References

►

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152	x_refsource_CONFIRM
	https://github.com/containers/libpod/issues/3211	x_refsource_CONFIRM
	https://github.com/containers/libpod/pull/3214	x_refsource_CONFIRM
	https://github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	Podman	podman	Version: fixed in 1.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T22:10:09.977Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/containers/libpod/issues/3211"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/containers/libpod/pull/3214"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140"
          },
          {
            "name": "openSUSE-SU-2019:2044",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "podman",
          "vendor": "Podman",
          "versions": [
            {
              "status": "affected",
              "version": "fixed in 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-09-01T23:06:07",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/containers/libpod/issues/3211"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/containers/libpod/pull/3214"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140"
        },
        {
          "name": "openSUSE-SU-2019:2044",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2019-10152",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "podman",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "fixed in 1.4.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Podman"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "7.5/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-59"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-22"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152"
            },
            {
              "name": "https://github.com/containers/libpod/issues/3211",
              "refsource": "CONFIRM",
              "url": "https://github.com/containers/libpod/issues/3211"
            },
            {
              "name": "https://github.com/containers/libpod/pull/3214",
              "refsource": "CONFIRM",
              "url": "https://github.com/containers/libpod/pull/3214"
            },
            {
              "name": "https://github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140",
              "refsource": "CONFIRM",
              "url": "https://github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140"
            },
            {
              "name": "openSUSE-SU-2019:2044",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2019-10152",
    "datePublished": "2019-07-30T22:07:23",
    "dateReserved": "2019-03-27T00:00:00",
    "dateUpdated": "2024-08-04T22:10:09.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20199 (GCVE-0-2021-20199)

Vulnerability from cvelistv5

Published

2021-02-02 18:12

Modified

2024-08-03 17:30

Severity ?

CWE

CWE-346

Summary

Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.

References

►

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=1919050	x_refsource_MISC
	https://github.com/containers/podman/issues/5138	x_refsource_MISC
	https://github.com/rootless-containers/rootlesskit/pull/206	x_refsource_MISC
	https://github.com/containers/podman/pull/9052	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	podman	Version: podman 1.8.0 onwards

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:30:07.575Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1919050"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/containers/podman/issues/5138"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rootless-containers/rootlesskit/pull/206"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/containers/podman/pull/9052"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "podman",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "podman 1.8.0 onwards"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-02-02T18:12:26",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1919050"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/containers/podman/issues/5138"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rootless-containers/rootlesskit/pull/206"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/containers/podman/pull/9052"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2021-20199",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "podman",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "podman 1.8.0 onwards"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-346"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1919050",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1919050"
            },
            {
              "name": "https://github.com/containers/podman/issues/5138",
              "refsource": "MISC",
              "url": "https://github.com/containers/podman/issues/5138"
            },
            {
              "name": "https://github.com/rootless-containers/rootlesskit/pull/206",
              "refsource": "MISC",
              "url": "https://github.com/rootless-containers/rootlesskit/pull/206"
            },
            {
              "name": "https://github.com/containers/podman/pull/9052",
              "refsource": "MISC",
              "url": "https://github.com/containers/podman/pull/9052"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-20199",
    "datePublished": "2021-02-02T18:12:26",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:30:07.575Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-1726 (GCVE-0-2020-1726)

Vulnerability from cvelistv5

Published

2020-02-11 19:45

Modified

2024-08-04 06:46

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-552

Summary

A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.

References

►

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1726	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2020:0680	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00097.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00103.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	The	podman	Version: from 1.6.0 onwards

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T06:46:30.890Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1726"
          },
          {
            "name": "RHSA-2020:0680",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0680"
          },
          {
            "name": "openSUSE-SU-2020:1552",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00097.html"
          },
          {
            "name": "openSUSE-SU-2020:1559",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00103.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "podman",
          "vendor": "The ",
          "versions": [
            {
              "status": "affected",
              "version": "from 1.6.0 onwards"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "CWE-552",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-28T14:06:06",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1726"
        },
        {
          "name": "RHSA-2020:0680",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0680"
        },
        {
          "name": "openSUSE-SU-2020:1552",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00097.html"
        },
        {
          "name": "openSUSE-SU-2020:1559",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00103.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-1726",
    "datePublished": "2020-02-11T19:45:26",
    "dateReserved": "2019-11-27T00:00:00",
    "dateUpdated": "2024-08-04T06:46:30.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14370 (GCVE-0-2020-14370)

Vulnerability from cvelistv5

Published

2020-09-23 00:00

Modified

2024-08-04 12:46

Severity ?

CWE

CWE-212

Summary

An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.

References

►

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=1874268
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6BPCZX4ASKNONL3MSCK564IVXNYSKLP/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y74V7HGQBNLT6XECCSNZNFZIB7G7XSAR/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4Y2FSGQWP4AFT5AZ6UBN6RKHVXUBRFV/	vendor-advisory

Impacted products

	Vendor	Product	Version
	n/a	podman	Version: podman versions before 2.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:46:33.326Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1874268"
          },
          {
            "name": "FEDORA-2020-76fcd0ba34",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6BPCZX4ASKNONL3MSCK564IVXNYSKLP/"
          },
          {
            "name": "FEDORA-2020-7b6058fec9",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y74V7HGQBNLT6XECCSNZNFZIB7G7XSAR/"
          },
          {
            "name": "FEDORA-2020-3a4b8fca5e",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4Y2FSGQWP4AFT5AZ6UBN6RKHVXUBRFV/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "podman",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "podman versions before 2.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-212",
              "description": "CWE-212",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-07T00:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1874268"
        },
        {
          "name": "FEDORA-2020-76fcd0ba34",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6BPCZX4ASKNONL3MSCK564IVXNYSKLP/"
        },
        {
          "name": "FEDORA-2020-7b6058fec9",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y74V7HGQBNLT6XECCSNZNFZIB7G7XSAR/"
        },
        {
          "name": "FEDORA-2020-3a4b8fca5e",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z4Y2FSGQWP4AFT5AZ6UBN6RKHVXUBRFV/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-14370",
    "datePublished": "2020-09-23T00:00:00",
    "dateReserved": "2020-06-17T00:00:00",
    "dateUpdated": "2024-08-04T12:46:33.326Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-10856 (GCVE-0-2018-10856)

Vulnerability from cvelistv5

Published

2018-07-02 18:00

Modified

2024-08-05 07:46

Severity ?

5.3 (Medium) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-250

Summary

It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.

References

►

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10856	x_refsource_CONFIRM
	https://github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:2037	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	[UNKNOWN]	podman	Version: podman 0.6.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:46:47.230Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10856"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24"
          },
          {
            "name": "RHSA-2018:2037",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2037"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "podman",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "podman 0.6.1"
            }
          ]
        }
      ],
      "datePublic": "2018-06-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-07-03T09:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10856"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24"
        },
        {
          "name": "RHSA-2018:2037",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2037"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-10856",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "podman",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "podman 0.6.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "[UNKNOWN]"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "5.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-250"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10856",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10856"
            },
            {
              "name": "https://github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24",
              "refsource": "CONFIRM",
              "url": "https://github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24"
            },
            {
              "name": "RHSA-2018:2037",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2037"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-10856",
    "datePublished": "2018-07-02T18:00:00",
    "dateReserved": "2018-05-09T00:00:00",
    "dateUpdated": "2024-08-05T07:46:47.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

opensuse-su-2024:11177-1

Vulnerability from csaf_opensuse

CVE-2019-10214 (GCVE-0-2019-10214)

Vulnerability from cvelistv5

CVE-2019-10152 (GCVE-0-2019-10152)

Vulnerability from cvelistv5

CVE-2021-20199 (GCVE-0-2021-20199)

Vulnerability from cvelistv5

CVE-2020-1726 (GCVE-0-2020-1726)

Vulnerability from cvelistv5

CVE-2020-14370 (GCVE-0-2020-14370)

Vulnerability from cvelistv5

CVE-2018-10856 (GCVE-0-2018-10856)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature