Vulnerabilidade de Transversal de Caminho no Podman leva à leitura/escrita arbitrária de arquivos em github.com/containers/podman

The Path Traversal vulnerability in Podman (CVE-2019-10152) enables an attacker to bypass intended access controls and interact with files outside of the intended container environment. Successful exploitation could lead to the disclosure of sensitive data, modification of system files, or even remote code execution if the attacker can leverage the file access to execute malicious code. The blast radius extends to the entire host system, as the vulnerability bypasses container isolation mechanisms. This is particularly concerning in multi-tenant environments or systems hosting critical infrastructure.

Organizations heavily reliant on containerization technologies, particularly those using Podman for development, testing, or production deployments, are at risk. Environments with shared hosting or multi-tenant container setups are especially vulnerable, as a compromise of one container could potentially impact others. Legacy Podman installations running older, unpatched versions are also at heightened risk.

• go / container: Inspect Podman container configurations for unusual file paths or access permissions.

ps aux | grep podman

• linux / server: Monitor system logs for suspicious file access attempts, particularly those involving traversal sequences (e.g., '../').

journalctl -u podman -f | grep "../"

• generic web: Examine Podman API endpoints for potential vulnerabilities related to file handling. Use curl to test for directory traversal.

curl 'http://localhost:8080/v1/containers/json?name=mycontainer&path=../../../../etc/passwd' #Example - adjust URL

1. 2024-08-20Disclosure

   disclosure

1. Reservado2019-03-27
2. Publicada2024-08-20
3. Modificada2026-03-03
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2019-10152 is to upgrade Podman to version 1.4.0 or later, which includes the necessary fix. If an immediate upgrade is not feasible due to compatibility issues or system downtime constraints, consider implementing stricter access controls within the container environment to limit the potential impact of a successful exploit. While not a complete solution, restricting file system access for containers can reduce the attacker's ability to read or write sensitive files. Review and harden container configurations to minimize the attack surface. After upgrade, confirm by attempting to access files outside the intended container directory and verifying access is denied.