Localhost Traffic Vulnerability in Podman - CVE-2021-20199
Summary
UBUNTU-CVE-2021-20199: Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). Affects libpod versions 3.2.1+ds1-2ubuntu3 – 3.4.4+ds1-1ubuntu1.22.04.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is an open-source container management tool that allows users to create, manage, and run containers without requiring a daemon. It is designed to be a drop-in replacement for Docker, providing a similar command-line interface and functionality. The package is widely used for developing and deploying applications in isolated environments. However, a vulnerability has been identified that affects Podman versions 1.8.0 and later, which could compromise the security of applications relying on localhost connections.
Vulnerability Detail
The vulnerability arises from the way rootless containers in Podman handle incoming traffic. Specifically, all traffic is received with a source IP address of 127.0.0.1, including traffic from remote hosts. This can lead to security issues for containerized applications that trust connections from localhost by default and do not implement proper authentication mechanisms. As a result, malicious actors could exploit this flaw to gain unauthorized access to sensitive data or services running within the container.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement network policies or firewall rules to restrict access to the containerized applications, ensuring that only trusted sources can communicate with them. Additionally, consider using authentication mechanisms for services that rely on localhost connections.
Conclusion
CVE-2021-20199 is a significant vulnerability affecting Podman that could lead to unauthorized access to containerized applications. Users are strongly advised to update to the latest patched versions of Podman to mitigate this risk. Implementing workarounds can provide temporary relief until an update can be applied.
See every vulnerability recorded for libpod →
FAQ
CVE-2021-20199 is a vulnerability in Podman that allows rootless containers to receive all traffic with a source IP address of 127.0.0.1, potentially exposing applications to unauthorized access.
Podman versions 1.8.0 and later are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score of CVE-2021-20199 is 5.9, indicating a medium severity level.
If you cannot update Podman right away, implement network policies or firewall rules to restrict access to your applications and consider using authentication for services that rely on localhost connections.
Related vulnerabilities
Recent vulnerabilities recorded for libpod.
