It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a
    container as a non-root user. This results in unnecessary privileges being granted to the container.
    (CVE-2018-10856)

Weekly release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:2037 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    The following packages have been upgraded to a later upstream version: podman (0.6.1). (BZ#1584429)

    Security Fix(es):

    * podman: Containers run as non-root users do not drop capabilities (CVE-2018-10856)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
432318	SCA: security update for github.com/containers/podman (GHSA-wp7w-vx86-vj9h)	Tenable Cloud Security	SCA Checks	high
432318	SCA: security update for github.com/containers/podman (GHSA-wp7w-vx86-vj9h)	Tenable Self-Hosted Container Security	SCA Checks	high
120314	Fedora 28 : podman (2018-2b96ea9fec)	Nessus	Fedora Local Security Checks	high
110913	Fedora 27 : podman (2018-5142d70592)	Nessus	Fedora Local Security Checks	high
110715	RHEL 7 : podman (RHSA-2018:2037)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2018-10856

high

Tenable Plugins

high

high

high

high

high