A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:0705 advisory.

  - A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged     container are not correctly checked. This flaw can be abused by a low-privileged user inside the container     to access any other file in the container, even if owned by the root user inside the container. It does     not allow to directly escape the container, though being a privileged container means that a lot of     security features are disabled when running the container. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability. (CVE-2021-20188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:0706 advisory.

  - A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged     container are not correctly checked. This flaw can be abused by a low-privileged user inside the container     to access any other file in the container, even if owned by the root user inside the container. It does     not allow to directly escape the container, though being a privileged container means that a lot of     security features are disabled when running the container. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability. (CVE-2021-20188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0706 advisory.

  - A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged     container are not correctly checked. This flaw can be abused by a low-privileged user inside the container     to access any other file in the container, even if owned by the root user inside the container. It does     not allow to directly escape the container, though being a privileged container means that a lot of     security features are disabled when running the container. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability. (CVE-2021-20188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0705 advisory.

  - A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged     container are not correctly checked. This flaw can be abused by a low-privileged user inside the container     to access any other file in the container, even if owned by the root user inside the container. It does     not allow to directly escape the container, though being a privileged container means that a lot of     security features are disabled when running the container. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability. (CVE-2021-20188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0710 advisory.

  - podman: container users permissions are not respected in privileged containers (CVE-2021-20188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:0705 advisory.

  - podman: container users permissions are not respected in privileged containers (CVE-2021-20188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:0706 advisory.

  - podman: container users permissions are not respected in privileged containers (CVE-2021-20188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0705 advisory.

  - podman: container users permissions are not respected in privileged containers (CVE-2021-20188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0706 advisory.

  - podman: container users permissions are not respected in privileged containers (CVE-2021-20188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0681 advisory.

  - podman: container users permissions are not respected in privileged containers (CVE-2021-20188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3053 advisory.

  - QEMU: slirp: use-after-free in ip_reass() function in ip_input.c (CVE-2020-1983)

  - podman: container users permissions are not respected in privileged containers (CVE-2021-20188)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
184732	Rocky Linux 8 : container-tools:1.0 (RLSA-2021:0705)	Nessus	Rocky Linux Local Security Checks	high
184724	Rocky Linux 8 : container-tools:2.0 (RLSA-2021:0706)	Nessus	Rocky Linux Local Security Checks	high
147170	Oracle Linux 8 : container-tools:2.0 (ELSA-2021-0706)	Nessus	Oracle Linux Local Security Checks	high
147166	Oracle Linux 8 : container-tools:1.0 (ELSA-2021-0705)	Nessus	Oracle Linux Local Security Checks	high
147009	RHEL 8 : container-tools:2.0 (RHSA-2021:0710)	Nessus	Red Hat Local Security Checks	high
146964	CentOS 8 : container-tools:1.0 (CESA-2021:0705)	Nessus	CentOS Local Security Checks	high
146963	CentOS 8 : container-tools:2.0 (CESA-2021:0706)	Nessus	CentOS Local Security Checks	high
146956	RHEL 8 : container-tools:1.0 (RHSA-2021:0705)	Nessus	Red Hat Local Security Checks	high
146950	RHEL 8 : container-tools:2.0 (RHSA-2021:0706)	Nessus	Red Hat Local Security Checks	high
146932	RHEL 7 : podman (RHSA-2021:0681)	Nessus	Red Hat Local Security Checks	high
138804	RHEL 8 : container-tools:rhel8 (RHSA-2020:3053)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2021-20188

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high