CVE-2020-1726

CVSS 5.9 MEDIUMEPSS 1.8%CWE-552

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.9EPSS 1.8%KEV nãoPoC —Patch referenciado

Lifecycle

Feb 11, 2020Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

The · podman

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00097.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00103.html https://access.redhat.com/errata/RHSA-2020:0680 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1726