{"id":"EUVD-2022-5384","revision":"28dc2b7a8bea4107bacfddfa1bf5d8cd","records":[{"revision":"28dc2b7a8bea4107bacfddfa1bf5d8cd","observedAt":"2026-11-03T18:03:04.427+00:00","statement":{"source":"euvd","id":"EUVD-2022-5384","aliases":["CVE-2020-1726","GHSA-vmhj-p9hw-vgrf"],"title":"A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious im…","description":"A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","score":5.9,"severity":null}],"references":["https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1726","https://access.redhat.com/errata/RHSA-2020:0680","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00097.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00103.html"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5384","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Feb 11, 2020, 7:45:26 PM","dateUpdated":"Aug 4, 2024, 6:46:30 AM"},"relatedAdvisories":[{"id":"RHSA-2020:0680","title":"Red Hat Security Advisory: OpenShift Container Platform 4.3.5 podman security update","vulnerabilityIds":["CVE-2020-1726"]},{"id":"SUSE-SU-2020:2731-1","title":"Security update for conmon, fuse-overlayfs, libcontainers-common, podman","vulnerabilityIds":["CVE-2020-1726"]},{"id":"openSUSE-SU-2024:11177-1","title":"podman-3.3.1-2.1 on GA media","vulnerabilityIds":["CVE-2018-10856","CVE-2019-10152","CVE-2019-10214","CVE-2020-14370","CVE-2020-1726","CVE-2021-20199"]},{"id":"WID-SEC-W-2022-1089","title":"Red Hat OpenShift Container Platform: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2019-19921","CVE-2020-1726","CVE-2020-8945"]},{"id":"openSUSE-SU-2020:1559-1","title":"Security update for conmon, fuse-overlayfs, libcontainers-common, podman","vulnerabilityIds":["CVE-2020-1726"]},{"id":"openSUSE-SU-2020:1552-1","title":"Security update for conmon, fuse-overlayfs, libcontainers-common, podman","vulnerabilityIds":["CVE-2020-1726"]},{"id":"RHSA-2020:1650","title":"Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2019-19921","CVE-2020-1702","CVE-2020-1726"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2022-5384","identifiers":["EUVD-2022-5384","CVE-2020-1726","GHSA-vmhj-p9hw-vgrf"]},"retained":false,"historicalAffected":[]}],"coverage":[]}