VulnerabilityModified
CVE-2021-20199
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts).
MEDIUM 5.9EPSS 1.15%
Does this matter?
Lower severity and a low EPSS score (1.15%). Track it; it rarely justifies an emergency change on its own.
Description
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 1.15% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-346
- Affected
- podman project/podman
- Source
- secalert@redhat.com
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1919050Issue Tracking, Third Party Advisory
- https://github.com/containers/podman/issues/5138Exploit, Third Party Advisory
- https://github.com/containers/podman/pull/9052Patch, Third Party Advisory
- https://github.com/rootless-containers/rootlesskit/pull/206Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1919050Issue Tracking, Third Party Advisory
- https://github.com/containers/podman/issues/5138Exploit, Third Party Advisory
- https://github.com/containers/podman/pull/9052Patch, Third Party Advisory
- https://github.com/rootless-containers/rootlesskit/pull/206Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.