GO-2023-1681

vendorUSosv

Time-of-check time-of-use race condition in github.com/containers/podman/v4

view advisory published 2023-04-03Licence: per source

A Time-of-check Time-of-use (TOCTOU) flaw appears in this version of podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-0778US	medium6.8	0.54% (45th)	—	2023-03-27
A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume,…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=2168256WEB
https://github.com/advisories/GHSA-qwqv-rqgf-8qh8ADVISORY
https://github.com/containers/podman/commit/6ca857feb07a5fdc96fd947afef03916291673d8FIX
https://github.com/containers/podman/pull/17528FIX
https://github.com/containers/podman/pull/17532FIX

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan