Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1919050 | Issue Tracking Third Party Advisory |
| https://github.com/containers/podman/issues/5138 | Exploit Third Party Advisory |
| https://github.com/containers/podman/pull/9052 | Patch Third Party Advisory |
| https://github.com/rootless-containers/rootlesskit/pull/206 | Patch Third Party Advisory |
Configurations
History
26 Feb 2021, 03:32
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 5.9 |
08 Feb 2021, 16:54
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| CPE | cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:* | |
| References | (MISC) https://github.com/rootless-containers/rootlesskit/pull/206 - Patch, Third Party Advisory | |
| References | (MISC) https://github.com/containers/podman/pull/9052 - Patch, Third Party Advisory | |
| References | (MISC) https://github.com/containers/podman/issues/5138 - Exploit, Third Party Advisory | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1919050 - Issue Tracking, Third Party Advisory |
02 Feb 2021, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-02-02 19:15
Updated : 2023-12-10 13:41
NVD link : CVE-2021-20199
Mitre link : CVE-2021-20199
CVE.ORG link : CVE-2021-20199
JSON object : View
Products Affected
podman_project
- podman
CWE
CWE-346
Origin Validation Error