PatchTheCVElibpod vulnerabilities and fixes
Recent CVEs affecting libpod, with upgrade or downgrade steps. 5 tracked.
libpod has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2020-02-11. Highest priority: CVE-2020-1726 (score 50/100).
- CVE-2020-1726 MEDIUM 5.9 DOWNGRADE DOWNGRADE A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing file
- CVE-2019-18466 MEDIUM 5.5 UPGRADE An issue was discovered in Podman in libpod before 1.6.0
- CVE-2019-10214 MEDIUM 5.9 MITIGATE MITIGATE The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Lin
- CVE-2019-10152 HIGH 7.2 UPGRADE MITIGATE A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlin
- CVE-2018-10856 MEDIUM 5.3 UPGRADE It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container
FAQ
How do I fix libpod vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libpod being exploited right now?
None of the tracked libpod CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libpod CVE should I patch first?
CVE-2020-1726 currently ranks highest (50/100): A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing file.