CVE-2023-0778

MEDIUM

Podman < 4.4.2 - Time-of-check Time-of-use Race Condition via Volume Export

Title source: llm

Description

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

References (1)

Core 1

Core References

Issue Tracking, Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2168256

Scores

CVSS v3 6.8

EPSS 0.0016

EPSS Percentile 36.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-367

Status published

Products (4)

containers/podman 0 - 4.4.2Go

podman_project/podman

redhat/enterprise_linux 8.0

redhat/enterprise_linux 9.0

Published Mar 27, 2023

Tracked Since Feb 18, 2026