CVE-2021-4024 — Sensitive Information Exposure

Vendor	Product	Version range	Fixed in
debian	libpod	< libpod 3.4.3+ds1-1 (bookworm)	libpod 3.4.3+ds1-1 (bookworm)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
github.com	containers_podman_v3	>= 0 < 3.4.3	3.4.3
libpod_project	libpod	>= 0 < 3.4.3+ds1-1	3.4.3+ds1-1
podman_project	podman	—	—
podman_project	podman	>= 3.3.0 < 3.4.3	3.4.3
redhat	enterprise_linux	—	—

OSV

Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman in github.com/containers/podman

osv·2024-08-21

CVE-2021-4024 Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman in github.com/containers/podman Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman in github.com/containers/podman Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman in github.com/containers/podman

GHSA

Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman

ghsa·2022-01-06

CVE-2021-4024 [MEDIUM] CWE-200 Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.

OSV

Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman

osv·2022-01-06

CVE-2021-4024 [MEDIUM] Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.

OSV

CVE-2021-4024: A flaw was found in podman

osv·2021-12-23·CVSS 6.5

CVE-2021-4024 [MEDIUM] CVE-2021-4024: A flaw was found in podman A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.

Red Hat

podman: podman machine spawns gvproxy with port bound to all IPs

vendor_redhat·2021-11-24·CVSS 6.5

CVE-2021-4024 [MEDIUM] CWE-200 podman: podman machine spawns gvproxy with port bound to all IPs podman: podman machine spawns gvproxy with port bound to all IPs A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM. A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on t

Debian

CVE-2021-4024: libpod - A flaw was found in podman. The `podman machine` function (used to create and ma...

vendor_debian·2021·CVSS 6.5

CVE-2021-4024 [MEDIUM] CVE-2021-4024: libpod - A flaw was found in podman. The `podman machine` function (used to create and ma... A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM. Scope: local bookworm: resolved (fixed in 3.4.3+ds1-1) bullseye: resolved

CVE-2021-4024: A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy`…

Affected

CVSS provenance