CVE-2019-18466 Podman Symlink Vulnerability
An attacker can craft a container image with symlinks that, when copied to the host, overwrite host files due to improper symlink resolution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-18466?
CVE-2019-18466 is a medium-severity path traversal vulnerability in n/a, published on 28 Oct 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a victim user to the host filesystem, may overwrite existing files with others from the host.
Weakness: CWE-59
Which versions are affected by CVE-2019-18466?
7 open source packages ship an affected version, including github.com/containers/podman/v4, github.com/containers/libpod and github.com/containers/podman. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containers/podman/v4 Go | All versions | None |
github.com/containers/podman/v4 Go | All versions | 1.6.0 |
github.com/containers/podman/v4 Go | All versions | 1.6.0 |
github.com/containers/libpod Go | All versions | 1.6.0 |
github.com/containers/podman Go | All versions | None |
github.com/containers/podman/v2 Go | All versions | None |
1 more packages
github.com/containers/podman/v3 Go | All versions | None |
Linux distribution packages (12)
cni SUSE:Linux Enterprise Module for Containers 15 SP1 | All versions | 0.7.1-3.3.1 |
cni-plugins SUSE:Linux Enterprise Module for Containers 15 SP1 | All versions | 0.8.4-3.3.1 |
conmon SUSE:Linux Enterprise Module for Containers 15 SP1 | All versions | 2.0.10-3.3.1 |
fuse-overlayfs SUSE:Linux Enterprise Module for Containers 15 SP1 | All versions | 0.7.6-3.6.1 |
podman SUSE:Linux Enterprise Module for Containers 15 SP1 | All versions | 1.8.0-4.14.1 |
cni SUSE:Linux Enterprise Module for Public Cloud 15 SP1 | All versions | 0.7.1-3.3.1 |
cni-plugins SUSE:Linux Enterprise Module for Public Cloud 15 SP1 | All versions | 0.8.4-3.3.1 |
cni openSUSE:Leap 15.1 | All versions | 0.7.1-lp151.2.3.1 |
cni-plugins openSUSE:Leap 15.1 | All versions | 0.8.4-lp151.2.3.1 |
conmon openSUSE:Leap 15.1 | All versions | 2.0.10-lp151.2.1 |
fuse-overlayfs openSUSE:Leap 15.1 | All versions | 0.7.6-lp151.5.1 |
podman openSUSE:Leap 15.1 | All versions | 1.8.0-lp151.3.9.1 |
Products include Libpod Project Libpod.
How do I fix CVE-2019-18466?
Upgrade github.com/containers/podman/v4 to 1.6.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-18466 being exploited?
There is no known exploitation of CVE-2019-18466 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-r34v-gqmw-qvgj, GO-2023-1942, SUSE-SU-2020:0697-1, openSUSE-SU-2020:0398-1.