CVE-2019-18466
Fixed in a distro release EPSS 1%
An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a victim user to the host filesystem, may overwrite existing files with others from the host.
Products: libpod_project libpod
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/containers/libpod | 1.6.0 |
| Go | github.com/containers/podman/v4 | 1.6.0 |
Affected upstream, no fix yet
| Ecosystem | Package |
|---|---|
| Go | github.com/containers/podman |
| Go | github.com/containers/podman/v2 |
| Go | github.com/containers/podman/v3 |
| Go | github.com/containers/podman/v4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 8 | buildah | 0:1.9.0-5.module+el8.1.0+4240+893c1ab8 |
| Red Hat Enterprise Linux 8 | buildah-debuginfo | 0:1.9.0-5.module+el8.1.0+4240+893c1ab8 |
| Red Hat Enterprise Linux 8 | buildah-debugsource | 0:1.9.0-5.module+el8.1.0+4240+893c1ab8 |
| Red Hat Enterprise Linux 8 | buildah-tests | 0:1.9.0-5.module+el8.1.0+4240+893c1ab8 |
| Red Hat Enterprise Linux 8 | buildah-tests-debuginfo | 0:1.9.0-5.module+el8.1.0+4240+893c1ab8 |
| Red Hat Enterprise Linux 8 | cockpit-podman | 0:4-1.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | container-selinux | 2:2.123.0-2.module+el8.1.0+4900+9d7326b8 |
| Red Hat Enterprise Linux 8 | containernetworking-plugins | 0:0.8.1-3.module+el8.1.0+4881+045289ee |
| Red Hat Enterprise Linux 8 | containernetworking-plugins-debuginfo | 0:0.8.1-3.module+el8.1.0+4881+045289ee |
| Red Hat Enterprise Linux 8 | containernetworking-plugins-debugsource | 0:0.8.1-3.module+el8.1.0+4881+045289ee |
| Red Hat Enterprise Linux 8 | containers-common | 1:0.1.37-6.module+el8.1.0+4876+e678a192 |
| Red Hat Enterprise Linux 8 | fuse-overlayfs | 0:0.4.1-1.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | fuse-overlayfs-debuginfo | 0:0.4.1-1.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | fuse-overlayfs-debugsource | 0:0.4.1-1.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | oci-systemd-hook | 1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | oci-systemd-hook-debuginfo | 1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | oci-systemd-hook-debugsource | 1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | oci-umount | 2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | oci-umount-debuginfo | 2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | oci-umount-debugsource | 2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | podman | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | podman-debuginfo | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | podman-debugsource | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | podman-docker | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | podman-manpages | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | podman-remote | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | podman-remote-debuginfo | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | podman-tests | 0:1.4.2-6.module+el8.1.0+4830+f49150d7 |
| Red Hat Enterprise Linux 8 | python-podman-api | 0:1.2.0-0.1.gitd0a45fe.module+el8.1.0+4081+b29780af |
| Red Hat Enterprise Linux 8 | runc | 0:1.0.0-61.rc8.module+el8.1.0+4873+4a24e241 |
| Red Hat Enterprise Linux 8 | runc-debuginfo | 0:1.0.0-61.rc8.module+el8.1.0+4873+4a24e241 |
| Red Hat Enterprise Linux 8 | runc-debugsource | 0:1.0.0-61.rc8.module+el8.1.0+4873+4a24e241 |
| Red Hat Enterprise Linux 8 | skopeo | 1:0.1.37-6.module+el8.1.0+4876+e678a192 |
| Red Hat Enterprise Linux 8 | skopeo-debuginfo | 1:0.1.37-6.module+el8.1.0+4876+e678a192 |
| Red Hat Enterprise Linux 8 | skopeo-debugsource | 1:0.1.37-6.module+el8.1.0+4876+e678a192 |
| Red Hat Enterprise Linux 8 | skopeo-tests | 1:0.1.37-6.module+el8.1.0+4876+e678a192 |
| Red Hat Enterprise Linux 8 | slirp4netns | 0:0.3.0-4.module+el8.1.0+4306+1d917805 |
| Red Hat Enterprise Linux 8 | slirp4netns-debuginfo | 0:0.3.0-4.module+el8.1.0+4306+1d917805 |
| Red Hat Enterprise Linux 8 | slirp4netns-debugsource | 0:0.3.0-4.module+el8.1.0+4306+1d917805 |
| Red Hat Enterprise Linux 8 | toolbox | 0:0.0.4-1.module+el8.1.0+4081+b29780af |
| Red Hat rhel extras other 7 | podman | 0:1.6.4-16.el7_8 |
| Red Hat rhel extras other 7 | podman-debuginfo | 0:1.6.4-16.el7_8 |
| Red Hat rhel extras other 7 | podman-docker | 0:1.6.4-16.el7_8 |
| Rocky Linux 8 | oci-systemd-hook | 1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f |
| Rocky Linux 8 | oci-umount | 2:2.3.4-2.git87f9237.module+el8.4.0+557+48ba8b2f |
| SUSE Linux Enterprise Module for Containers 15 SP1 | cni | 0.7.1-3.3.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | cni-plugins | 0.8.4-3.3.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | conmon | 2.0.10-3.3.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | fuse-overlayfs | 0.7.6-3.6.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | podman | 1.8.0-4.14.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP1 | cni | 0.7.1-3.3.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP1 | cni-plugins | 0.8.4-3.3.1 |
| openSUSE Leap 15.1 | cni | 0.7.1-lp151.2.3.1 |
| openSUSE Leap 15.1 | cni-plugins | 0.8.4-lp151.2.3.1 |
| openSUSE Leap 15.1 | conmon | 2.0.10-lp151.2.1 |
| openSUSE Leap 15.1 | fuse-overlayfs | 0.7.6-lp151.5.1 |
| openSUSE Leap 15.1 | podman | 1.8.0-lp151.3.9.1 |