CVE-2021-4024 — Sensitive Information Exposure in Containers Podman V3
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 73.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 23
Latest updateAug 21
Description
A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to …
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:LExploitability: 3.9 | Impact: 2.5
Affected Packages4 packages
Also affects: Fedora 34, 35, Enterprise Linux 8.0
🔴Vulnerability Details
5OSV▶
Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman in github.com/containers/podman↗2024-08-21
GHSA▶
Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman↗2022-01-06
OSV▶
Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman↗2022-01-06