CVE-2021-4024
Description
A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.
How to fix
- podman_project podman3.4.3 or later
- github.com/containers/podman/v33.4.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| podman_project podman | 3.3.0 ≤ v < 3.4.3 | 3.4.3 |
| fedoraproject fedora | 34, 35 | — |
| redhat enterprise_linux | 8.0 | — |
| github.com/containers/podman/v3Go | v < 3.4.3 | 3.4.3 |
| github.com/containers/podmanGo | No range specified | — |
| github.com/containers/podman/v2Go | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.