CVE-2019-10152CWE-22CWE-59

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers

High · published July 30, 2019

CVSS v3.0
7.5
EPSS
0%
Percentile
39.6
In the wild
Unconfirmed
What it is

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00468 · 39.6th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2019-07-30T22:07Z
EPSS history
Timeline
  • 30 JUL 22:07Z
    A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers
    cvelistv5