← Back to CVEs

CVE-2020-1726

MEDIUM

5.9

Description

A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.

CVE Details

CVSS v3.1 Score5.9

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack VectorNETWORK

ComplexityHIGH

Privileges RequiredNONE

User InteractionNONE

Published2/11/2020

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

libpod_project:libpodredhat:enterprise_linuxredhat:openshift_container_platform

Weaknesses (CWE)

CWE-552CWE-552

References

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00097.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00103.html(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2020:0680(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1726(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00097.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00103.html(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2020:0680(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1726(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.