Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
podman project podman vulnerabilities and exploits
(subscribe to this query)
5.9
CVSSv3
CVE-2021-20199
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podma...
Podman Project Podman
5.9
CVSSv3
CVE-2020-1726
A flaw exists in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the...
Libpod Project Libpod 1.6.0
Redhat Enterprise Linux 8.0
Redhat Openshift Container Platform 4.3
5.9
CVSSv3
CVE-2019-10214
The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulne...
Buildah Project Buildah -
Libpod Project Libpod -
Redhat Openshift Container Platform 4.1
Skopeo Project Skopeo -
Redhat Enterprise Linux 8.0
Opensuse Leap 15.1
5.5
CVSSv3
CVE-2019-18466
An issue exists in Podman in libpod prior to 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when c...
Libpod Project Libpod
5.3
CVSSv3
CVE-2022-41717
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the s...
Golang Go
Golang Http2
Fedoraproject Fedora 37
Fedoraproject Fedora 38
1 Github repository
5.3
CVSSv3
CVE-2022-4122
A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure.
Podman Project Podman 4.3.0
Fedoraproject Fedora 35
Fedoraproject Fedora 36
Fedoraproject Fedora 37
5.3
CVSSv3
CVE-2022-2739
The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-14370, which was previously fixed via RHSA-2020:5056. This issue could possibly allow an malicious user to gain...
Redhat Enterprise Linux Workstation 7.0
Redhat Enterprise Linux Server 7.0
Podman Project Podman 1.6.4-32.el7 9
5.3
CVSSv3
CVE-2020-14370
An information disclosure vulnerability was found in containers/podman in versions prior to 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container w...
Podman Project Podman
Redhat Enterprise Linux 7.0
Redhat Enterprise Linux 8.0
Redhat Openshift Container Platform 4.6
Fedoraproject Fedora 31
Fedoraproject Fedora 32
Fedoraproject Fedora 33
3.3
CVSSv3
CVE-2022-4123
A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
Podman Project Podman 4.2.1
Podman Project Podman 4.1.1
Podman Project Podman 4.2.0
Podman Project Podman 4.1.0
Podman Project Podman 4.3.0
Fedoraproject Fedora 35
Fedoraproject Fedora 36
Fedoraproject Fedora 37
3.3
CVSSv3
CVE-2020-1702
A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker can use this flaw to trick a user, with privileges to pull container im...
Containers-image Project Containers-image
Redhat Enterprise Linux 8.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-3201
CVE-2024-4779
CVE-2024-35090
CVE-2024-5084
hard-coded
CVE-2024-4985
HTML injection
CVE-2024-33655
local file inclusion
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3