CVE-2020-1726

podman · Vulnerability

CVSS 3.1 5.9 MEDIUMEUVD CVSS 3.1 5.9 CVSS 3.1 · [email protected] · Secondary 5.9 MEDIUMCVSS 3.1 · [email protected] · Primary 5.9 MEDIUMCVSS 2.0 · [email protected] · Primary 5.8 MEDIUMCVSS_V3 Publisher rating MODERATEFixed by github.com/containers/podman 2.0.6 Fixed by github.com/containers/podman/v2 2.0.6osv · severity unknownFixed by github.com/containers/libpod/v2 2.0.6KEV status unknown

Original advisory

cve-program · CVE-2020-1726

Published

A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.

Read the publisher's advisory

euvd · EUVD-2022-5384

Published

Read the publisher's advisory

nvd · CVE-2020-1726

Published

Read the publisher's advisory

osv · GHSA-vmhj-p9hw-vgrf

Published

Read the publisher's advisory

osv · GO-2023-1544

Published

Podman has Files or Directories Accessible to External Parties in github.com/containers/libpod

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2020-1726

Published

podman

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "product": "podman",
                    "vendor": "The",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "from 1.6.0 onwards"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2022-5384

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Feb 11, 2020, 7:45:26 PM

dateUpdated: Aug 4, 2024, 6:46:30 AM

8 related source bulletins · separate from aliases

RHSA-2020:0680: Red Hat Security Advisory: OpenShift Container Platform 4.3.5 podman security update

CVE-2020-1726

SUSE-SU-2020:2731-1: Security update for conmon, fuse-overlayfs, libcontainers-common, podman

CVE-2020-1726

openSUSE-SU-2024:11177-1: podman-3.3.1-2.1 on GA media

CVE-2018-10856 · CVE-2019-10152 · CVE-2019-10214 · CVE-2020-14370 · CVE-2020-1726 · CVE-2021-20199

WID-SEC-W-2022-1089: Red Hat OpenShift Container Platform: Mehrere Schwachstellen

CVE-2019-19921 · CVE-2020-1726 · CVE-2020-8945

openSUSE-SU-2020:1559-1: Security update for conmon, fuse-overlayfs, libcontainers-common, podman

CVE-2020-1726

openSUSE-SU-2020:1552-1: Security update for conmon, fuse-overlayfs, libcontainers-common, podman

CVE-2020-1726

RHSA-2020:1650: Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

CVE-2019-19921 · CVE-2020-1702 · CVE-2020-1726

RHBA-2020:0581: Red Hat Bug Fix Advisory: OpenShift Container Platform 4.4 image release advisory

CVE-2019-19335 · CVE-2019-19351 · CVE-2019-19355 · CVE-2019-19921 · CVE-2020-1726 · CVE-2020-2099 · CVE-2020-2100 · CVE-2020-2101 · CVE-2020-2102 · CVE-2020-2103 · CVE-2020-2104 · CVE-2020-2105 · CVE-2020-8551 · CVE-2020-8552 · CVE-2020-8945 · CVE-2020-10696

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2020-1726

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Modified

Weakness classifications: CWE-552

Original publisher date fields

published: 2020-02-11T20:15:12.070

lastModified: 2026-06-17T03:02:16.953

3 source CPE criteria · context only

cpe:2.3:a:libpod_project:libpod:1.6.0:-:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-vmhj-p9hw-vgrf

Published

github.com/containers/podman

SEMVER · introduced 1.6.0 → fixed 2.0.6

github.com/containers/podman/v2

SEMVER · introduced 0 → fixed 2.0.6

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GO-2023-1544

Published

github.com/containers/libpod

SEMVER · introduced 1.6.0

github.com/containers/libpod/v2

SEMVER · introduced 0 → fixed 2.0.6

Original source record · Cite this exact observation · Complete original publisher JSON