-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper symlink resolution during 'podman cp' operations. The GitHub PR #3214 fix explicitly mentions using securejoin to resolve paths safely within the container's context, indicating the original implementation in cmd/podman/cp.go lacked proper symlink containment. The CWE-22/CWE-59 mapping confirms this was a path traversal via insecure link resolution. The function responsible for copy operations (copyBetweenHostAndContainer) would be the logical point where this vulnerability manifested, as it handled path construction without adequate safeguards against symlink-based escapes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/containers/podman | go | < 1.4.0 | 1.4.0 |