~ / search / GHSA-qwqv-rqgf-8qh8

GHSA-qwqv-rqgf-8qh8

Podman Time-of-check Time-of-use (TOCTOU) Race Condition

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-0778

Packages

EcosystemPackageAffectedFixed in
Go github.com/containers/podman/v4 < 4.4.2 4.4.2

Details

As written in the advisory (Markdown source, shown as plain text).

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

References

External links from the advisory. They lead to third-party sites.