CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
Percentile
58.7%
A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume. This issue was introduced in version 1.6.0.
Vendor | Product | Version | CPE |
---|---|---|---|
containers | podman | * | cpe:2.3:a:containers:podman:*:*:*:*:*:*:*:* |
lists.opensuse.org/opensuse-security-announce/2020-09/msg00097.html
lists.opensuse.org/opensuse-security-announce/2020-09/msg00103.html
access.redhat.com/errata/RHSA-2020:0680
access.redhat.com/errata/RHSA-2020:1650
access.redhat.com/security/cve/CVE-2020-1726
bugzilla.redhat.com/show_bug.cgi?id=1801152
bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1726
github.com/advisories/GHSA-vmhj-p9hw-vgrf
github.com/containers/podman/commit/c140ecdc9b416ab4efd4d21d14acd63b6adbdd42
nvd.nist.gov/vuln/detail/CVE-2020-1726
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
Percentile
58.7%