CVE-2019-10152

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-30 · updated 2026-06-17
Weakness: CWE-22

Description

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.

Affected products

Libpod Project Libpod: before 1.4.0 — fixed in 1.4.0
openSUSE Leap: 15.1

How to fix

Upgrade to a fixed version: Libpod Project Libpod 1.4.0. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152
https://github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140
https://github.com/containers/libpod/issues/3211
https://github.com/containers/libpod/pull/3214
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152
https://github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140
https://github.com/containers/libpod/issues/3211
https://github.com/containers/libpod/pull/3214

Get alerted when CVE-2019-10152 or the next vulnerability affects your stack