SB2020040151 - OpenSUSE Linux update for cni, cni-plugins, conmon, fuse-overlayfs, podman 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020040151

SB2020040151 - OpenSUSE Linux update for cni, cni-plugins, conmon, fuse-overlayfs, podman

Published: April 1, 2020

Security Bulletin ID SB2020040151
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) UNIX symbolic link following (CVE-ID: CVE-2019-18466)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a symlink following issue in libpod (podman) in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a victim user to the host filesystem, may overwrite existing files with others from the host.

Successful exploitation of this vulnerability may result in privilege escalation on the host operating system.


Remediation

Install update from vendor's website.

References