Localhost Trust Vulnerability in Podman and Rootlesskit Packages
Summary
CVE-2021-20199: Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). Affects libpod across 2 version ranges.
>= 2ced9094d4728dd09f60a177faa32339a8d0f721, < 5b2585f5e91ca148f068cefa647c23f8b1ade622
< 3.0.0~rc2+dfsg1-2
Fixed in 3.0.0~rc2+dfsg1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is a container management tool that allows users to create and manage containers without requiring a daemon. It is designed for rootless operation, enhancing security by allowing users to run containers without root privileges. Rootlesskit is a tool that facilitates the creation of rootless containers. The vulnerability in question affects these packages by allowing rootless containers to receive traffic with a source IP address of 127.0.0.1, which can lead to security risks for applications that trust localhost connections.
Vulnerability Detail
The vulnerability, identified as CVE-2021-20199, arises from the way rootless containers handle incoming traffic. When running with Podman, all traffic is perceived as originating from localhost (127.0.0.1), including traffic from remote hosts. This can mislead containerized applications that inherently trust connections from localhost, potentially allowing unauthorized access without proper authentication. The issue affects Podman versions 1.8.0 and later, as well as corresponding versions of rootlesskit.
How To Fix
Minimum fixed version
3.0.0~rc2+dfsg1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpodTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional authentication mechanisms for applications that rely on localhost connections. This can help mitigate the risk of unauthorized access until the packages are updated.
Conclusion
CVE-2021-20199 presents a significant risk for applications using Podman and rootlesskit due to the misrepresentation of traffic source IPs. Users are strongly advised to upgrade to the latest versions of the affected packages and consider implementing additional security measures in the interim.
See every vulnerability recorded for libpod →
FAQ
CVE-2021-20199 is a vulnerability affecting Podman and rootlesskit that allows rootless containers to receive traffic from remote hosts as if it originated from localhost.
Podman versions 1.8.0 and later are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If immediate updates are not possible, implement additional authentication for applications that trust localhost connections to mitigate potential risks.
The CVSS score for CVE-2021-20199 is 5.9, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for libpod.
