CVE-2019-18466

Name of the Vulnerable Software and Affected Versions Podman versions prior to 1.6.0

Description The issue is related to the handling of symbolic links in the libpod library of Podman. It allows an attacker to create a container image with specific symlinks that, when copied to the host filesystem by a victim user, may overwrite existing files with other files from the host. This could potentially lead to unauthorized modifications of the host system.

Recommendations For versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the copy operation from the container to the host to minimize the risk of exploitation. Avoid using Podman to copy files from containers to the host filesystem until the issue is resolved.