Skip to content
Fencer Intel
medium 5.5

CVE-2019-18466 json

Podman Symlink Vulnerability

published 7y ago modified 4mo ago also GHSA-r34v-gqmw-qvgj , GO-2023-1942 , EUVD-2022-5078

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a victim user to the host filesystem, may overwrite existing files with others from the host.

Patch / fix

  • go github.com/containers/podman/v4 1.6.0
  • go github.com/containers/libpod 1.6.0
  • libpod_project libpod 1.6.0
  • runc RHEL 8 1.0.0-61.rc8.module+el8.1.0+4873+4a24e241
  • podman RHEL 8 1.4.2-6.module+el8.1.0+4830+f49150d7
  • skopeo RHEL 8 1:0.1.37-6.module+el8.1.0+4876+e678a192
  • buildah RHEL 8 1.9.0-5.module+el8.1.0+4240+893c1ab8
  • toolbox RHEL 8 0.0.4-1.module+el8.1.0+4081+b29780af
  • oci-umount RHEL 8 2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af
  • slirp4netns RHEL 8 0.3.0-4.module+el8.1.0+4306+1d917805
  • podman-tests RHEL 8 1.4.2-6.module+el8.1.0+4830+f49150d7

red hat advisories RHSA-2019:4269RHSA-2020:1227

  • podman SLE Module for Containers 15 SP1 1.8.0-4.14.1
  • cni SLE Module for Public Cloud 15 SP1, SLE Module for Containers 15 SP1 0.7.1-3.3.1
  • conmon SLE Module for Containers 15 SP1 2.0.10-3.3.1
  • cni-plugins SLE Module for Public Cloud 15 SP1, SLE Module for Containers 15 SP1 0.8.4-3.3.1
  • fuse-overlayfs SLE Module for Containers 15 SP1 0.7.6-3.6.1

suse advisories SUSE-SU-2020:0697-1

  • podman openSUSE Leap 15.1 1.8.0-lp151.3.9.1
  • cni openSUSE Leap 15.1 0.7.1-lp151.2.3.1
  • conmon openSUSE Leap 15.1 2.0.10-lp151.2.1
  • cni-plugins openSUSE Leap 15.1 0.8.4-lp151.2.3.1
  • fuse-overlayfs openSUSE Leap 15.1 0.7.6-lp151.5.1

opensuse advisories openSUSE-SU-2020:0398-1

  • oci-umount AlmaLinux 8 2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082
  • oci-umount AlmaLinux 8 2:2.3.4-2.git87f9237.module_el8.4.0+2496+12421f43
  • oci-umount AlmaLinux 8 2:2.3.4-2.git87f9237.module_el8.3.0+2044+12421f43
  • oci-systemd-hook AlmaLinux 8 1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082
  • oci-systemd-hook AlmaLinux 8 1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43
  • oci-systemd-hook AlmaLinux 8 1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43

almalinux advisories ALSA-2019:4269

  • oci-umount Rocky Linux 8 2:2.3.4-2.git87f9237.module+el8.4.0+557+48ba8b2f
  • oci-systemd-hook Rocky Linux 8 1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f

rocky linux advisories RLSA-2019:4269

Is CVE-2019-18466 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-18466 updated cvss 2.5

podman: resolving symlink in host filesystem leads to unexpected results of copy operation

  • Red Hat OpenShift Container Platform 4 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +2 more
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 Extras podman 1.6.4-16.el7_8, podman-docker 1.6.4-16.el7_8
    fixed: vendor fix RHSA-2020:1227
  • Red Hat Enterprise Linux AppStream (v. 8) podman 1.4.2-6.module+el8.1.0+4830+f49150d7, buildah 1.9.0-5.module+el8.1.0+4240+893c1ab8, skopeo 0.1.37-6.module+el8.1.0+4876+e678a192, toolbox 0.0.4-1.module+el8.1.0+4081+b29780af, runc 1.0.0-61.rc8.module+el8.1.0+4873+4a24e241, cockpit-podman 4-1.module+el8.1.0+4081+b29780af, +14 more
    fixed: vendor fix RHSA-2019:4269
  • Red Hat Enterprise Linux 8 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +2 more Red Hat OpenShift Container Platform 3.11 podman
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.39% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/containers/libpod/issues/3829 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/containers/podman/v4
<1.6.0
all versions
1.6.0
go github.com/containers/libpod
<1.6.0
1.6.0
go github.com/containers/podman
all versions
 no fix listed
go github.com/containers/podman/v2
all versions
 no fix listed
go github.com/containers/podman/v3
all versions
 no fix listed

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.