CVE-2020-1726: Medium severity Libpod Project Libpod vulnerability
A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.
Other sources
podman incorrectly allows containers, when created, to populate volumes that already have existing data inside. A malicious container image may use this flaw to overwrite existing files in a volume, even if it is mounted in read-only mode. The attack is possible only the first time a volume is used.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/podmanto a version that resolves this vulnerability.Fixed in 0:1.6.4-7.el8 - Upgrade
Upgrade
podmanto a version that resolves this vulnerability.Fixed in 1.6.0 - Compensating control
If a volume must be attached as read-only to an untrusted container or container image, first attach the volume to a trusted container (do this before the untrusted container uses it).
- Operational
Use the volume once with a trusted container first; the described attack is possible only the first time a volume is used, after which other containers using the volume can no longer trigger the flaw.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-1726?
CVE-2020-1726 is a vulnerability discovered in Podman that allows containers to overwrite existing files in volumes, even if they are mounted as read-only.
What is the severity of CVE-2020-1726?
CVE-2020-1726 has a severity rating of medium with a CVSS score of 5.9.
How does CVE-2020-1726 affect Podman?
CVE-2020-1726 affects Podman by allowing containers to overwrite existing files in volumes.
How can I fix CVE-2020-1726?
To fix CVE-2020-1726, update Podman to version 1.6.4-7.el8 or later.
Are there any references for CVE-2020-1726?
You can find more information about CVE-2020-1726 at the following references: [link1], [link2], [link3].