CVE-2021-20199
Fixed in a distro release EPSS 1%
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.
Products: podman_project podman
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/containers/podman/v3 | 3.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | cockpit-podman | 29-2.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | conmon | 2:2.0.26-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | containernetworking-plugins | 0.9.1-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | crit | 3.15-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | criu | 3.15-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | fuse-overlayfs | 1.4.0-2.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | libslirp | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | libslirp-devel | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | python3-criu | 3.15-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | slirp4netns | 1.1.8-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | udica | 0.2.4-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 9 | podman | 2:4.2.0-3.el9 |
| AlmaLinux 9 | podman-docker | 2:4.2.0-3.el9 |
| AlmaLinux 9 | podman-gvproxy | 2:4.2.0-3.el9 |
| AlmaLinux 9 | podman-plugins | 2:4.2.0-3.el9 |
| AlmaLinux 9 | podman-remote | 2:4.2.0-3.el9 |
| AlmaLinux 9 | podman-tests | 2:4.2.0-3.el9 |
| Arch Linux | podman | 3.0.0-1 |
| Debian 12 | libpod | 3.0.0~rc2+dfsg1-2 |
| Debian 12 | rootlesskit | 0.12.0-1 |
| Debian 13 | rootlesskit | 0.12.0-1 |
| Debian 14 | rootlesskit | 0.12.0-1 |
| Red Hat Enterprise Linux 8 | buildah | 0:1.19.7-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | buildah-debuginfo | 0:1.19.7-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | buildah-debugsource | 0:1.19.7-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | buildah-tests | 0:1.19.7-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | buildah-tests-debuginfo | 0:1.19.7-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | cockpit-podman | 0:29-2.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | conmon | 2:2.0.26-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | conmon-debuginfo | 2:2.0.26-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | conmon-debugsource | 2:2.0.26-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | container-selinux | 2:2.158.0-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | containernetworking-plugins | 0:0.9.1-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | containernetworking-plugins-debuginfo | 0:0.9.1-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | containernetworking-plugins-debugsource | 0:0.9.1-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | containers-common | 1:1.2.2-8.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | crit | 0:3.15-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | criu | 0:3.15-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | criu-debuginfo | 0:3.15-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | criu-debugsource | 0:3.15-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | crun | 0:0.18-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | crun-debuginfo | 0:0.18-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | crun-debugsource | 0:0.18-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | fuse-overlayfs | 0:1.4.0-2.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | fuse-overlayfs-debuginfo | 0:1.4.0-2.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | fuse-overlayfs-debugsource | 0:1.4.0-2.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | libslirp | 0:4.3.1-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | libslirp-debuginfo | 0:4.3.1-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | libslirp-debugsource | 0:4.3.1-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | libslirp-devel | 0:4.3.1-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | oci-seccomp-bpf-hook | 0:1.2.0-2.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | oci-seccomp-bpf-hook-debuginfo | 0:1.2.0-2.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | oci-seccomp-bpf-hook-debugsource | 0:1.2.0-2.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | podman | 0:3.0.1-6.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | podman-catatonit | 0:3.0.1-6.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | podman-catatonit-debuginfo | 0:3.0.1-6.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | podman-debuginfo | 0:3.0.1-6.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | podman-debugsource | 0:3.0.1-6.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | podman-docker | 0:3.0.1-6.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | podman-plugins | 0:3.0.1-6.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | podman-plugins-debuginfo | 0:3.0.1-6.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | podman-remote | 0:3.0.1-6.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | podman-remote-debuginfo | 0:3.0.1-6.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | podman-tests | 0:3.0.1-6.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | python3-criu | 0:3.15-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | runc | 0:1.0.0-70.rc92.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | runc-debuginfo | 0:1.0.0-70.rc92.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | runc-debugsource | 0:1.0.0-70.rc92.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | skopeo | 1:1.2.2-8.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | skopeo-debuginfo | 1:1.2.2-8.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | skopeo-debugsource | 1:1.2.2-8.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | skopeo-tests | 1:1.2.2-8.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | slirp4netns | 0:1.1.8-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | slirp4netns-debuginfo | 0:1.1.8-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | slirp4netns-debugsource | 0:1.1.8-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | toolbox | 0:0.0.8-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 8 | udica | 0:0.2.4-1.module+el8.4.0+10607+f4da7515 |
| Red Hat Enterprise Linux 9 | podman | 2:4.2.0-3.el9 |
| Red Hat Enterprise Linux 9 | podman-catatonit-debuginfo | 2:4.2.0-3.el9 |
| Red Hat Enterprise Linux 9 | podman-debuginfo | 2:4.2.0-3.el9 |
| Red Hat Enterprise Linux 9 | podman-debugsource | 2:4.2.0-3.el9 |
| Red Hat Enterprise Linux 9 | podman-docker | 2:4.2.0-3.el9 |
| Red Hat Enterprise Linux 9 | podman-gvproxy | 2:4.2.0-3.el9 |
| Red Hat Enterprise Linux 9 | podman-gvproxy-debuginfo | 2:4.2.0-3.el9 |
| Red Hat Enterprise Linux 9 | podman-plugins | 2:4.2.0-3.el9 |
| Red Hat Enterprise Linux 9 | podman-plugins-debuginfo | 2:4.2.0-3.el9 |
| Red Hat Enterprise Linux 9 | podman-remote | 2:4.2.0-3.el9 |
| Red Hat Enterprise Linux 9 | podman-remote-debuginfo | 2:4.2.0-3.el9 |
| Red Hat Enterprise Linux 9 | podman-tests | 2:4.2.0-3.el9 |
| Rocky Linux 8 | buildah | 0:1.19.7-1.module+el8.4.0+558+7340b765 |
| Rocky Linux 8 | cockpit-podman | 0:29-2.module+el8.7.0+1076+9b1c11c1 |
| Rocky Linux 8 | cockpit-podman | 0:29-2.module+el8.4.0+556+40122d08 |
| Rocky Linux 8 | cockpit-podman | 0:29-2.module+el8.5.0+709+440d5e7e |
| Rocky Linux 8 | cockpit-podman | 0:29-2.module+el8.6.0+783+10209741 |
| Rocky Linux 8 | conmon | 2:2.0.26-1.module+el8.4.0+558+7340b765 |
| Rocky Linux 8 | conmon | 2:2.0.26-1.module+el8.5.0+709+440d5e7e |
| Rocky Linux 8 | conmon | 2:2.0.26-1.module+el8.6.0+783+10209741 |
| Rocky Linux 8 | container-selinux | 2:2.158.0-1.module+el8.4.0+558+7340b765 |
| Rocky Linux 8 | containernetworking-plugins | 0:0.9.1-1.module+el8.5.0+709+440d5e7e |
| Rocky Linux 8 | containernetworking-plugins | 0:0.9.1-1.module+el8.7.0+1076+9b1c11c1 |
| Rocky Linux 8 | containernetworking-plugins | 0:0.9.1-1.module+el8.4.0+556+40122d08 |
| Rocky Linux 8 | containernetworking-plugins | 0:0.9.1-1.module+el8.6.0+783+10209741 |
| Rocky Linux 8 | criu | 0:3.15-1.module+el8.7.0+1076+9b1c11c1 |
| Rocky Linux 8 | criu | 0:3.15-1.module+el8.4.0+556+40122d08 |
| Rocky Linux 8 | criu | 0:3.15-1.module+el8.5.0+709+440d5e7e |
| Rocky Linux 8 | criu | 0:3.15-1.module+el8.6.0+783+10209741 |
| Rocky Linux 8 | fuse-overlayfs | 0:1.4.0-2.module+el8.4.0+558+7340b765 |
| Rocky Linux 8 | fuse-overlayfs | 0:1.4.0-2.module+el8.5.0+709+440d5e7e |
| Rocky Linux 8 | fuse-overlayfs | 0:1.4.0-2.module+el8.7.0+1076+9b1c11c1 |
| Rocky Linux 8 | fuse-overlayfs | 0:1.4.0-2.module+el8.6.0+783+10209741 |
| Rocky Linux 8 | libslirp | 0:4.3.1-1.module+el8.7.0+1076+9b1c11c1 |
| Rocky Linux 8 | libslirp | 0:4.3.1-1.module+el8.4.0+556+40122d08 |
| Rocky Linux 8 | libslirp | 0:4.3.1-1.module+el8.5.0+709+440d5e7e |
| Rocky Linux 8 | libslirp | 0:4.3.1-1.module+el8.6.0+783+10209741 |
| Rocky Linux 8 | oci-seccomp-bpf-hook | 0:1.2.0-2.module+el8.4.0+556+40122d08 |
| Rocky Linux 8 | podman | 0:3.0.1-6.module+el8.4.0+558+7340b765 |
| Rocky Linux 8 | podman | 0:3.0.1-6.module+el8.5.0+709+440d5e7e |
| Rocky Linux 8 | skopeo | 1:1.2.2-8.module+el8.5.0+661+c0df01f6 |
| Rocky Linux 8 | slirp4netns | 0:1.1.8-1.module+el8.7.0+1076+9b1c11c1 |
| Rocky Linux 8 | slirp4netns | 0:1.1.8-1.module+el8.4.0+537+38cf4e42 |
| Rocky Linux 8 | slirp4netns | 0:1.1.8-1.module+el8.5.0+709+440d5e7e |
| Rocky Linux 8 | slirp4netns | 0:1.1.8-1.module+el8.6.0+783+10209741 |
| Rocky Linux 8 | toolbox | 0:0.0.8-1.module+el8.4.0+556+40122d08 |
| Rocky Linux 8 | udica | 0:0.2.4-1.module+el8.7.0+1076+9b1c11c1 |
| Rocky Linux 8 | udica | 0:0.2.4-1.module+el8.4.0+556+40122d08 |
| Rocky Linux 8 | udica | 0:0.2.4-1.module+el8.5.0+709+440d5e7e |
| Rocky Linux 8 | udica | 0:0.2.4-1.module+el8.6.0+783+10209741 |
| SUSE Enterprise Storage 6 | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Enterprise Storage 7 | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Enterprise Storage 7.1 | podman | 4.3.1-150300.9.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | podman | 4.3.1-150300.9.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | podman | 4.3.1-150300.9.15.1 |
| SUSE Linux Enterprise Micro 5.1 | conmon | 2.0.30-150300.8.3.1 |
| SUSE Linux Enterprise Micro 5.1 | libcontainers-common | 20210626-150300.8.3.1 |
| SUSE Linux Enterprise Micro 5.1 | libseccomp | 2.5.3-150300.10.5.1 |
| SUSE Linux Enterprise Micro 5.1 | podman | 4.3.1-150300.9.15.1 |
| SUSE Linux Enterprise Micro 5.1 | podman | 3.4.4-150300.9.3.2 |
| SUSE Linux Enterprise Micro 5.2 | podman | 4.3.1-150300.9.15.1 |
| SUSE Linux Enterprise Micro 5.3 | podman | 4.3.1-150400.4.11.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | libcontainers-common | 20210626-150300.8.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | libseccomp | 2.5.3-150300.10.5.1 |
| SUSE Linux Enterprise Module for Containers 15 SP3 | conmon | 2.0.30-150300.8.3.1 |
| SUSE Linux Enterprise Module for Containers 15 SP3 | podman | 3.4.4-150300.9.3.2 |
| SUSE Linux Enterprise Module for Containers 15 SP4 | podman | 4.3.1-150400.4.11.1 |
| SUSE Linux Enterprise Server 15 SP1-BCL | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise Server 15 SP2-BCL | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | podman | 4.3.1-150300.9.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | podman | 4.3.1-150300.9.15.1 |
| SUSE Manager Proxy 4.1 | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Manager Retail Branch Server 4.1 | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Manager Server 4.1 | libcontainers-common | 20210626-150100.3.15.1 |
| Ubuntu Pro 22.04 LTS | libpod | no fix |
| Ubuntu Pro 24.04 LTS | libpod | no fix |
| openSUSE Leap 15.3 | conmon | 2.0.30-150300.8.3.1 |
| openSUSE Leap 15.3 | libcontainers-common | 20210626-150300.8.3.1 |
| openSUSE Leap 15.3 | libseccomp | 2.5.3-150300.10.5.1 |
| openSUSE Leap 15.3 | podman | 3.4.4-150300.9.3.2 |
| openSUSE Leap 15.4 | podman | 4.3.1-150400.4.11.1 |
| openSUSE Leap Micro 5.2 | podman | 4.3.1-150300.9.15.1 |
| openSUSE Leap Micro 5.3 | podman | 4.3.1-150400.4.11.1 |
| openSUSE Tumbleweed | libcontainers-common | 20210626-7.1 |
| openSUSE Tumbleweed | podman | 3.3.1-2.1 |