CVE-2020-1726 Podman has Files or Directories Accessible to External Parties
Malicious containers can overwrite files in read-only volumes, allowing unauthorized data modification within the host filesystem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-1726?
CVE-2020-1726 is a medium-severity missing authorization vulnerability in Redhat Enterprise Linux, published on 11 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
Weakness: CWE-552
Which versions are affected by CVE-2020-1726?
6 open source packages ship an affected version, including github.com/containers/podman, github.com/containers/libpod and github.com/containers/libpod/v2. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containers/podman Go | From 1.6.0 | 2.0.6 |
github.com/containers/podman Go | From 1.6.0 | 2.0.6 |
github.com/containers/libpod Go | From 1.6.0 | None |
github.com/containers/libpod/v2 Go | All versions | 2.0.6 |
github.com/containers/podman/v2 Go | All versions | 2.0.6 |
github.com/containers/podman/v2 Go | All versions | 2.0.6 |
Linux distribution packages (24)
podman Red Hat:openshift:4.3::el8 | All versions | 0:1.6.4-7.el8 |
podman-debuginfo Red Hat:openshift:4.3::el8 | All versions | 0:1.6.4-7.el8 |
podman-debugsource Red Hat:openshift:4.3::el8 | All versions | 0:1.6.4-7.el8 |
podman-docker Red Hat:openshift:4.3::el8 | All versions | 0:1.6.4-7.el8 |
podman-manpages Red Hat:openshift:4.3::el8 | All versions | 0:1.6.4-7.el8 |
podman-remote Red Hat:openshift:4.3::el8 | All versions | 0:1.6.4-7.el8 |
podman-remote-debuginfo Red Hat:openshift:4.3::el8 | All versions | 0:1.6.4-7.el8 |
podman-tests Red Hat:openshift:4.3::el8 | All versions | 0:1.6.4-7.el8 |
libcontainers-common SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 20200727-3.12.1 |
libcontainers-common SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 20200727-3.12.1 |
conmon SUSE:Linux Enterprise Module for Containers 15 SP1 | All versions | 2.0.20-3.6.1 |
fuse-overlayfs SUSE:Linux Enterprise Module for Containers 15 SP1 | All versions | 1.1.2-3.9.1 |
podman SUSE:Linux Enterprise Module for Containers 15 SP1 | All versions | 2.0.6-4.25.1 |
conmon SUSE:Linux Enterprise Module for Containers 15 SP2 | All versions | 2.0.20-3.6.1 |
fuse-overlayfs SUSE:Linux Enterprise Module for Containers 15 SP2 | All versions | 1.1.2-3.9.1 |
podman SUSE:Linux Enterprise Module for Containers 15 SP2 | All versions | 2.0.6-4.25.1 |
conmon openSUSE:Leap 15.1 | All versions | 2.0.20-lp151.5.1 |
fuse-overlayfs openSUSE:Leap 15.1 | All versions | 1.1.2-lp151.8.1 |
libcontainers-common openSUSE:Leap 15.1 | All versions | 20200727-lp151.2.10.1 |
podman openSUSE:Leap 15.1 | All versions | 2.0.6-lp151.3.21.1 |
conmon openSUSE:Leap 15.2 | All versions | 2.0.20-lp152.4.3.1 |
fuse-overlayfs openSUSE:Leap 15.2 | All versions | 1.1.2-lp152.2.3.1 |
libcontainers-common openSUSE:Leap 15.2 | All versions | 20200727-lp152.2.3.1 |
podman openSUSE:Leap 15.2 | All versions | 2.0.6-lp152.4.3.1 |
Products include Libpod Project Libpod, Redhat Enterprise Linux, Redhat Openshift Container Platform.
How do I fix CVE-2020-1726?
Upgrade github.com/containers/podman to 2.0.6 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-1726 being exploited?
There is no known exploitation of CVE-2020-1726 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
Sources
Also known as DEBIAN-CVE-2020-1726, GHSA-vmhj-p9hw-vgrf, GO-2023-1544, RHSA-2020:0680, SUSE-SU-2020:2731-1, openSUSE-SU-2020:1552-1 and 1 more.