A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0680 advisory.

  - podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created     (CVE-2020-1726)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0013 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-10214:
    The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise     Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the     container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack     and steal login credentials or bearer tokens.

    CVE-2019-18466:
    An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during     a copy operation from the container to the host, because an undesired glob operation occurs. An attacker     could create a container image containing particular symlinks that, when copied by a victim user to the     host filesystem, may overwrite existing files with others from the host.

    CVE-2019-9514:
    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both.

    CVE-2020-10696:
    A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to     trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to     the user's system anywhere that the user has permissions.

    CVE-2020-14040:
    The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String.

    CVE-2020-14370:
    An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When     using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in     a short duration, the environment variables from the first container will get leaked into subsequent     containers. An attacker who has control over the subsequent containers could use this flaw to gain access     to sensitive information stored in such variables.

    CVE-2020-1702:
    A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.

    CVE-2020-1726:
    A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing     files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a     container based on a malicious image with an attached volume that is used for the first time, it is     possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing
    files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a
    container based on a malicious image with an attached volume that is used for the first time, it is
    possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
    (CVE-2020-1726)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:1650 advisory.

  - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.) (CVE-2019-19921)

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

  - A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing     files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a     container based on a malicious image with an attached volume that is used for the first time, it is     possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
    (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1650 advisory.

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

  - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.) (CVE-2019-19921)

  - A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing     files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a     container based on a malicious image with an attached volume that is used for the first time, it is     possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
    (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1650 advisory.

  - runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation     (CVE-2019-19921)

  - containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

  - podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created     (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1650 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation     (CVE-2019-19921)

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    * podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created     (CVE-2020-1726)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0680 advisory.

    The podman tool manages Pods, container images, and containers. It is part of the libpod library, which is     for applications that use container Pods. Container Pods is a concept in Kubernetes.

    Security Fix(es):

    * podman: incorrectly allowed existing files in volumes to be overwritten by a container when it was     created (CVE-2020-1726)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
312452	RHCOS 4 : OpenShift Container Platform 4.3.5 podman (RHSA-2020:0680)	Nessus	Red Hat Local Security Checks	medium
236549	Alibaba Cloud Linux 3 : 0013: container-tools:rhel8 (ALINUX3-SA-2021:0013)	Nessus	Alibaba Cloud Linux Local Security Checks	high
419422	SCA: security update for github.com/containers/podman, github.com/containers/podman/v2 (GHSA-vmhj-p9hw-vgrf)	Tenable Cloud Security	SCA Checks	medium
419422	SCA: security update for github.com/containers/podman, github.com/containers/podman/v2 (GHSA-vmhj-p9hw-vgrf)	Tenable Self-Hosted Container Security	SCA Checks	medium
185067	Rocky Linux 8 : container-tools:rhel8 (RLSA-2020:1650)	Nessus	Rocky Linux Local Security Checks	high
406421	Alpine: multiple podman packages: security update to 1.8.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406421	Alpine: multiple podman packages: security update to 1.8.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
180939	Oracle Linux 8 : container-tools:ol8 (ELSA-2020-1650)	Nessus	Oracle Linux Local Security Checks	high
145798	CentOS 8 : container-tools:rhel8 (CESA-2020:1650)	Nessus	CentOS Local Security Checks	high
143877	SUSE SLES15 Security Update : conmon, fuse-overlayfs, libcontainers-common, podman (SUSE-SU-2020:2731-1)	Nessus	SuSE Local Security Checks	medium
141155	openSUSE Security Update : conmon / fuse-overlayfs / libcontainers-common / etc (openSUSE-2020-1552)	Nessus	SuSE Local Security Checks	medium
141077	openSUSE Security Update : conmon / fuse-overlayfs / libcontainers-common / etc (openSUSE-2020-1559)	Nessus	SuSE Local Security Checks	medium
136053	RHEL 8 : container-tools:rhel8 (RHSA-2020:1650)	Nessus	Red Hat Local Security Checks	high
134390	RHEL 8 : OpenShift Container Platform 4.3.5 podman (RHSA-2020:0680)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2020-1726

medium

Tenable Plugins

medium

high

medium

medium

high

medium

medium

high

high

medium

medium

medium

high

medium