CVE-2023-0778
Medium
Description
A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.
SeverityMedium
CVSS6.8
Exploit probability—
Product
Podman
PublishedMar 27, 2023
First seenMar 27, 2023
Weakness typeCWE-367CWE-367
How to fix
Update
- github.com/containers/podman/v44.4.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| podman_project podman | No range specified | — |
| redhat enterprise_linux | 8.0, 9.0 | — |
| github.com/containers/podman/v4Go | v < 4.4.2 | 4.4.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.