CVE-2021-4024: Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman
Summary
CVE-2021-4024: Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman in github.com/containers/podman. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
- github.com/containers/podman/v3 · Go
- libpod · Debian:12
The same CVE-2021-4024 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Podman is an open-source container engine that allows users to manage containers and container images. It is written in Go and is widely used in various containerization platforms. However, a vulnerability has been discovered in podman that exposes sensitive information to unauthorized actors and also involves an origin validation error.
Vulnerability Detail
The vulnerability in podman allows an unauthorized actor to access sensitive information. This could lead to unauthorized access to containers, container images, and potentially sensitive data within those containers. Additionally, there is an origin validation error that could allow attackers to bypass security measures and execute malicious code within containers.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is highly recommended to update podman to the latest version as soon as possible.
Conclusion
The vulnerability in podman exposes sensitive information to unauthorized actors and includes an origin validation error. To mitigate this vulnerability, users should update podman to version 3.4.3 or later. There is currently no known workaround for this issue.
See every vulnerability recorded for github.com/containers/podman →
FAQ
This vulnerability could allow unauthorized actors to access sensitive information within containers and potentially execute malicious code.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this one.
Yes, all versions of podman prior to version 3.4.3 are affected by this vulnerability. It is important to update to the latest version to ensure your installation is secure.
There is currently no evidence of this vulnerability being actively exploited. However, it is still important to update podman to the latest version to mitigate the risk.
Yes, the developers of podman have released a patch for this vulnerability in version 3.4.3 of the github.com/containers/podman/v3 package. It is recommended to update to this version or later.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/podman.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
