CVE-2023-0778
Summary
| CVE | CVE-2023-0778 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2023-03-27 21:15:00 UTC |
|---|
| Updated | 2023-04-03 16:59:00 UTC |
|---|
| Description | A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| 2168256 – (CVE-2023-0778) CVE-2023-0778 podman: symlink exchange attack in podman export volume |
MISC |
bugzilla.redhat.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160678 Oracle Enterprise Linux Security Update for container-tools:ol8 (ELSA-2023-2758)
- 160696 Oracle Enterprise Linux Security Update for container-tools:4.0 (ELSA-2023-2802)
- 183433 Debian Security Update for libpod (CVE-2023-0778)
- 241486 Red Hat Update for container-tools:4.0 (RHSA-2023:2802)
- 241505 Red Hat Update for container-tools:rhel8 security (RHSA-2023:2758)
- 241546 Red Hat OpenShift Container Platform 4.13 Security Update (RHSA-2023:1325)
- 283728 Fedora Security Update for podman (FEDORA-2023-698b47d488)
- 283746 Fedora Security Update for podman (FEDORA-2023-998dbd3b79)
- 503216 Alpine Linux Security Update for podman
- 506159 Alpine Linux Security Update for podman
- 753904 SUSE Enterprise Linux Security Update for podman (SUSE-SU-2023:1812-1)
- 770186 Red Hat OpenShift Container Platform 4.13 Security Update (RHSA-2023:1325)
- 941090 AlmaLinux Security Update for container-tools:4.0 (ALSA-2023:2802)
- 941116 AlmaLinux Security Update for container-tools:rhel8 (ALSA-2023:2758)
