CVE-2021-20199

EUVD-2021-1086
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 69%
Affected Products (NVD)
VendorProductVersion
podman_projectpodman
1.8.0 ≤
𝑥
< 3.0.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libpod
bookworm
4.3.1+ds1-8+deb12u1
fixed
bullseye
3.0.1+dfsg1-3+deb11u5
fixed
sid
5.2.2+ds1-2
fixed
rootlesskit
bookworm
1.1.0-1
fixed
bullseye
0.14.2-1
fixed
sid
2.0.2-2
fixed
trixie
2.0.2-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libpod
bionic
dne
focal
dne
groovy
ignored
hirsute
ignored
impish
ignored
jammy
needs-triage
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needs-triage
trusty
dne
xenial
dne
Common Weakness Enumeration
References
https://bugzilla.redhat.com/show_bug.cgi?id=1919050
https://github.com/containers/podman/issues/5138
https://github.com/containers/podman/pull/9052
https://github.com/rootless-containers/rootlesskit/pull/206
https://bugzilla.redhat.com/show_bug.cgi?id=1919050
https://github.com/containers/podman/issues/5138
https://github.com/containers/podman/pull/9052
https://github.com/rootless-containers/rootlesskit/pull/206