CVE-2019-25067 - Podman/Varlink API Privilege Escalation

Back Back to CVE browser

HIGH

Podman/Varlink API Privilege Escalation

Published Jun 9, 2022

8.8

HIGH

CVSS 3.1

EPSS 2.55%

Description

A vulnerability, which was classified as critical, was found in Podman and Varlink 1.5.1. This affects an unknown part of the component API. The manipulation leads to Remote Privilege Escalation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-143949 was assigned to this vulnerability.

Affected products

Vendor n/a Product Podman Default
n/a
- Version
  1.5.1
  Status
  affected
  Constraints
  -
Vendor n/a Product Varlink Default
n/a
- Version
  1.5.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Podman

n/a

Version	Status	Constraints
1.5.1	affected	-

n/a

Varlink

n/a

Version	Status	Constraints
1.5.1	affected	-

Red Hat Enterprise Linux 7

podman

Fix deferred
Red Hat Enterprise Linux 8

container-tools:2.0/podman

Out of support scope
Red Hat Enterprise Linux 8

container-tools:3.0/podman

Not affected
Red Hat Enterprise Linux 8

container-tools:4.0/podman

Not affected
Red Hat Enterprise Linux 8

container-tools:rhel8/podman

Not affected
Red Hat Enterprise Linux 9

podman

Not affected
Red Hat OpenShift Container Platform 3.11

podman

Not affected
Red Hat OpenShift Container Platform 4

podman

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	podman	Fix deferred	n/a
Red Hat Enterprise Linux 8	container-tools:2.0/podman	Out of support scope	n/a
Red Hat Enterprise Linux 8	container-tools:3.0/podman	Not affected	n/a
Red Hat Enterprise Linux 8	container-tools:4.0/podman	Not affected	n/a
Red Hat Enterprise Linux 8	container-tools:rhel8/podman	Not affected	n/a
Red Hat Enterprise Linux 9	podman	Not affected	n/a
Red Hat OpenShift Container Platform 3.11	podman	Not affected	n/a
Red Hat OpenShift Container Platform 4	podman	Affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-305

References (9)

https://access.redhat.com/security/cve/CVE-2019-25067
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2097406
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-11512
Advisory
https://github.com/containers/podman/issues/21628
issue-tracking
https://nvd.nist.gov/vuln/detail/CVE-2019-25067
https://vuldb.com/?ctiid.143949
signaturepermissions-required
https://vuldb.com/?id.143949
vdb-entrytechnical-descriptionThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-25067
https://www.exploit-db.com/exploits/47500
exploitThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-25067		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2097406		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-11512		Advisory
https://github.com/containers/podman/issues/21628		issue-tracking
https://nvd.nist.gov/vuln/detail/CVE-2019-25067
https://vuldb.com/?ctiid.143949		signaturepermissions-required
https://vuldb.com/?id.143949		vdb-entrytechnical-descriptionThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-25067
https://www.exploit-db.com/exploits/47500		exploitThird Party AdvisoryVDB Entry