CVE-2019-10152 — HIGH (7.2)

Q: How severe is CVE-2019-10152?

CVE-2019-10152 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2019-10152?

Check the references section above for vendor advisories and patch information. Affected products include: Libpod Project Libpod, Opensuse Leap.

Vulnerability Description

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.

CVSS Score

7.2

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Libpod Project	Libpod	< 1.4.0
Opensuse	Leap	15.1

Related Weaknesses (CWE)

CWE-22 CWE-59

References

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.htmlMailing ListThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152Issue TrackingPatchThird Party Advisory
https://github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140Release NotesThird Party Advisory
https://github.com/containers/libpod/issues/3211Third Party Advisory
https://github.com/containers/libpod/pull/3214Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.htmlMailing ListThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152Issue TrackingPatchThird Party Advisory
https://github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140Release NotesThird Party Advisory
https://github.com/containers/libpod/issues/3211Third Party Advisory
https://github.com/containers/libpod/pull/3214Third Party Advisory

FAQ

What is CVE-2019-10152?

CVE-2019-10152 is a vulnerability with a CVSS score of 7.2 (HIGH). A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbi...

How severe is CVE-2019-10152?

CVE-2019-10152 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-10152?

Check the references section above for vendor advisories and patch information. Affected products include: Libpod Project Libpod, Opensuse Leap.