CVE-2019-10152

low-risk
Published 2019-07-30

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.

Do I need to act?

-
0.36% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.2/10 High
LOCAL / HIGH complexity

Affected Products (2)

Libpod

Affected Vendors

Opensuse Libpod Project

References (10)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152
Release Notes https://github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140
Third Party Advisory https://github.com/containers/libpod/issues/3211
Third Party Advisory https://github.com/containers/libpod/pull/3214
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152
Release Notes https://github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140
Third Party Advisory https://github.com/containers/libpod/issues/3211
Third Party Advisory https://github.com/containers/libpod/pull/3214
27
/ 100
low-risk
Severity 19/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 7/34 · Low