CVE-2021-20188: podman_project podman Incorrect Authorization

CVSS: 7.0v3.1HighModified

AliasesRHSA-2021:0681RHSA-2021:0705RHSA-2021:0710+4 more

Published 11-02-2021Last modified 03-08-2024

Vulnerability summary

CVE-2021-20188 is a high (CVSS 7.0) Incorrect Authorization vulnerability in podman_project podman. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.7% of scored vulnerabilities.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.0/10

010

High · v3.1 (NVD)

EPSS score

0.26%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2

RHSA-2020:3053 RHSA-2021:0706

Timeline

11-02-2021
PublishedVulnerability first disclosed.
03-08-2024
Last modifiedVulnerability information updated.

Description

A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.17.0v2.06.9

EPSS trend

Probability

0.26%

Chance of exploitation in the next 30 days

Percentile

17%

Versus all other CVEs

30-day change

0.00 pp

From 0.26% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.26%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected systems

Redhat48 products

enterprise_linuxEOL7.0 | 8.0
openshift_container_platform3.11
buildah< 0:1.5-8.gite94b4f9.module+el8.3.0+10171+12421f43 | < 0:1.11.6-7.module+el8.2.0+9938+46853747
buildah-debuginfo< 0:1.5-8.gite94b4f9.module+el8.3.0+10171+12421f43 | < 0:1.11.6-7.module+el8.2.0+9938+46853747
buildah-debugsource< 0:1.5-8.gite94b4f9.module+el8.3.0+10171+12421f43 | < 0:1.11.6-7.module+el8.2.0+9938+46853747

buildah-tests< 0:1.11.6-7.module+el8.2.0+9938+46853747
buildah-tests-debuginfo< 0:1.11.6-7.module+el8.2.0+9938+46853747
cockpit-podman< 0:11-1.module+el8.2.0+9938+46853747
conmon< 2:2.0.6-1.module+el8.2.0+9938+46853747
container-selinux< 2:2.124.0-1.gitf958d0c.module+el8.3.0+10171+12421f43 | < 2:2.124.0-1.module+el8.2.0+9938+46853747
containernetworking-plugins< 0:0.7.4-4.git9ebe139.module+el8.3.0+10171+12421f43 | < 0:0.8.3-4.module+el8.2.0+9938+46853747
containernetworking-plugins-debuginfo< 0:0.7.4-4.git9ebe139.module+el8.3.0+10171+12421f43 | < 0:0.8.3-4.module+el8.2.0+9938+46853747
containernetworking-plugins-debugsource< 0:0.7.4-4.git9ebe139.module+el8.3.0+10171+12421f43 | < 0:0.8.3-4.module+el8.2.0+9938+46853747
containers-common< 1:0.1.32-6.git1715c90.module+el8.3.0+10171+12421f43 | < 1:0.1.40-9.module+el8.2.0+9938+46853747
crit< 0:3.12-9.module+el8.3.0+10171+12421f43 | < 0:3.12-9.module+el8.2.0+9938+46853747
criu< 0:3.12-9.module+el8.3.0+10171+12421f43 | < 0:3.12-9.module+el8.2.0+9938+46853747
criu-debuginfo< 0:3.12-9.module+el8.3.0+10171+12421f43 | < 0:3.12-9.module+el8.2.0+9938+46853747
criu-debugsource< 0:3.12-9.module+el8.3.0+10171+12421f43 | < 0:3.12-9.module+el8.2.0+9938+46853747
fuse-overlayfs< 0:0.3-5.module+el8.3.0+10171+12421f43 | < 0:0.7.2-5.module+el8.2.0+9938+46853747
fuse-overlayfs-debuginfo< 0:0.3-5.module+el8.3.0+10171+12421f43 | < 0:0.7.2-5.module+el8.2.0+9938+46853747
fuse-overlayfs-debugsource< 0:0.3-5.module+el8.3.0+10171+12421f43 | < 0:0.7.2-5.module+el8.2.0+9938+46853747
oci-systemd-hook< 1:0.1.15-2.git2d0b8a3.module+el8.3.0+10171+12421f43
oci-systemd-hook-debuginfo< 1:0.1.15-2.git2d0b8a3.module+el8.3.0+10171+12421f43
oci-systemd-hook-debugsource< 1:0.1.15-2.git2d0b8a3.module+el8.3.0+10171+12421f43
oci-umount< 2:2.3.4-2.git87f9237.module+el8.3.0+10171+12421f43
oci-umount-debuginfo< 2:2.3.4-2.git87f9237.module+el8.3.0+10171+12421f43
oci-umount-debugsource< 2:2.3.4-2.git87f9237.module+el8.3.0+10171+12421f43
podman< 0:1.6.4-29.el7_9 | < 0:1.0.0-8.git921f98f.module+el8.3.0+10171+12421f43 | < 0:1.6.4-19.module+el8.2.0+10175+e12b0910
podman-debuginfo< 0:1.6.4-29.el7_9 | < 0:1.0.0-8.git921f98f.module+el8.3.0+10171+12421f43 | < 0:1.6.4-19.module+el8.2.0+10175+e12b0910
podman-debugsource< 0:1.0.0-8.git921f98f.module+el8.3.0+10171+12421f43 | < 0:1.6.4-19.module+el8.2.0+10175+e12b0910
podman-docker< 0:1.6.4-29.el7_9 | < 0:1.0.0-8.git921f98f.module+el8.3.0+10171+12421f43 | < 0:1.6.4-19.module+el8.2.0+10175+e12b0910
podman-remote< 0:1.6.4-19.module+el8.2.0+10175+e12b0910
podman-remote-debuginfo< 0:1.6.4-19.module+el8.2.0+10175+e12b0910
podman-tests< 0:1.6.4-19.module+el8.2.0+10175+e12b0910
python-podman-api< 0:1.2.0-0.2.gitd0a45fe.module+el8.2.0+9938+46853747
python3-criu< 0:3.12-9.module+el8.3.0+10171+12421f43 | < 0:3.12-9.module+el8.2.0+9938+46853747
runc< 0:1.0.0-56.rc5.dev.git2abd837.module+el8.3.0+10171+12421f43 | < 0:1.0.0-64.rc10.module+el8.2.0+9938+46853747
runc-debuginfo< 0:1.0.0-56.rc5.dev.git2abd837.module+el8.3.0+10171+12421f43 | < 0:1.0.0-64.rc10.module+el8.2.0+9938+46853747
runc-debugsource< 0:1.0.0-56.rc5.dev.git2abd837.module+el8.3.0+10171+12421f43 | < 0:1.0.0-64.rc10.module+el8.2.0+9938+46853747
skopeo< 1:0.1.32-6.git1715c90.module+el8.3.0+10171+12421f43 | < 1:0.1.40-9.module+el8.2.0+9938+46853747
skopeo-debuginfo< 1:0.1.32-6.git1715c90.module+el8.3.0+10171+12421f43 | < 1:0.1.40-9.module+el8.2.0+9938+46853747
skopeo-debugsource< 1:0.1.32-6.git1715c90.module+el8.3.0+10171+12421f43 | < 1:0.1.40-9.module+el8.2.0+9938+46853747
skopeo-tests< 1:0.1.40-9.module+el8.2.0+9938+46853747
slirp4netns< 0:0.1-5.dev.gitc4e1bc5.module+el8.3.0+10171+12421f43 | < 0:0.4.2-3.git21fdece.module+el8.2.0+9938+46853747
slirp4netns-debuginfo< 0:0.1-5.dev.gitc4e1bc5.module+el8.3.0+10171+12421f43 | < 0:0.4.2-3.git21fdece.module+el8.2.0+9938+46853747
slirp4netns-debugsource< 0:0.1-5.dev.gitc4e1bc5.module+el8.3.0+10171+12421f43 | < 0:0.4.2-3.git21fdece.module+el8.2.0+9938+46853747
toolbox< 0:0.0.7-1.module+el8.2.0+9938+46853747
udica< 0:0.2.1-2.module+el8.2.0+9938+46853747

Show all 48

Debian1 product

libpod< 2.0.2+dfsg1-3

Github.com/containers1 product

libpod< 1.7.0

Podman_project1 product

podman< 1.7.0

Ubuntu1 product

libpodAll versions (No fix recorded)

5 vendors · 52 products

References

18 links

bugzilla.redhat.com/show_bug.cgi?id=1915734X Refsource MISCREPORTWEBIssue TrackingPatchVendor Advisory
access.redhat.com/errata/RHSA-2021:0681Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1930552REPORT
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0681.jsonAdvisory
access.redhat.com/security/cve/CVE-2021-20188REPORT
www.cve.org/CVERecord?id=CVE-2021-20188AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2021-20188Advisory
access.redhat.com/errata/RHSA-2021:0705Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0705.jsonAdvisory

Show all 18 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities