CVE-2021-20199

Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
VendorProductVersion
podman_projectpodman
1.8.0 ≤
𝑥
< 3.0.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libpod
bullseye
3.0.1+dfsg1-3+deb11u5
fixed
bookworm
4.3.1+ds1-8+deb12u1
fixed
sid
5.2.2+ds1-2
fixed
rootlesskit
bullseye
0.14.2-1
fixed
bookworm
1.1.0-1
fixed
sid
2.0.2-2
fixed
trixie
2.0.2-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libpod
noble
needs-triage
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needs-triage
impish
ignored
hirsute
ignored
groovy
ignored
focal
dne
bionic
dne
xenial
dne
trusty
dne
Common Weakness Enumeration
References
https://bugzilla.redhat.com/show_bug.cgi?id=1919050
https://github.com/containers/podman/issues/5138
https://github.com/containers/podman/pull/9052
https://github.com/rootless-containers/rootlesskit/pull/206
https://bugzilla.redhat.com/show_bug.cgi?id=1919050
https://github.com/containers/podman/issues/5138
https://github.com/containers/podman/pull/9052
https://github.com/rootless-containers/rootlesskit/pull/206