~ / search / GHSA-r34v-gqmw-qvgj

GHSA-r34v-gqmw-qvgj

Podman Symlink Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-18466

Packages

EcosystemPackageAffectedFixed in
Go github.com/containers/podman/v4 < 1.6.0 1.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a victim user to the host filesystem, may overwrite existing files with others from the host.

References

External links from the advisory. They lead to third-party sites.