Skip to content
Fencer Vulns
high 7.0

CVE-2021-20188 json

Improper Authorization in github.com/containers/libpod

published 2021-02-11 5 y ago modified 2026-06-17 4 mo ago also GHSA-9h63-7qf6-mv6r , GO-2022-0641 , EUVD-2021-1027

cvss
7.0
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits
0
none known

Summary

A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Patch / fix

  • go github.com/containers/libpod 1.7.0
  • podman_project podman 1.7.0
  • libpod Debian 12 2.0.2+dfsg1-3

debian advisories DEBIAN-CVE-2021-20188

  • crit RHEL 8 3.12-9.module+el8.3.0+10188+4c10031c
  • criu RHEL 8 3.12-9.module+el8.3.0+10188+4c10031c
  • runc RHEL 8 1.0.0-64.rc10.module+el8.3.0+10188+4c10031c
  • udica RHEL 8 0.2.1-2.module+el8.3.0+10188+4c10031c
  • conmon RHEL 8 2:2.0.15-1.module+el8.3.0+10188+4c10031c
  • podman RHEL 8 1.6.4-26.module+el8.3.0+10188+4c10031c
  • skopeo RHEL 8 1:0.1.41-4.module+el8.3.0+10188+4c10031c
  • buildah RHEL 8 1.11.6-8.module+el8.3.0+10188+4c10031c

red hat advisories RHSA-2021:0710RHSA-2021:0706RHSA-2021:0705RHSA-2021:0681RHSA-2020:3053

  • crit AlmaLinux 8 3.12-9.module_el8.3.0+2044+12421f43
  • crit AlmaLinux 8 3.12-9.module_el8.4.0+2496+12421f43
  • crit AlmaLinux 8 3.12-9.module_el8.5.0+119+9a9ec082
  • criu AlmaLinux 8 3.12-9.module_el8.4.0+2496+12421f43
  • criu AlmaLinux 8 3.12-9.module_el8.3.0+2044+12421f43
  • criu AlmaLinux 8 3.12-9.module_el8.5.0+119+9a9ec082
  • udica AlmaLinux 8 0.2.1-2.module_el8.5.0+108+00865455
  • udica AlmaLinux 8 0.2.1-2.module_el8.5.0+2635+e4386a39

almalinux advisories ALSA-2021:0706ALSA-2021:0705ALSA-2020:3053

  • criu Rocky Linux 8 3.12-9.module+el8.5.0+681+c9a1951f
  • criu Rocky Linux 8 3.12-9.module+el8.4.0+557+48ba8b2f
  • udica Rocky Linux 8 0.2.1-2.module+el8.5.0+770+e2f49861
  • udica Rocky Linux 8 0.2.1-2.module+el8.4.0+559+c02fa3b2
  • udica Rocky Linux 8 0.2.1-2.module+el8.5.0+708+6758137d
  • conmon Rocky Linux 8 2:2.0.15-1.module+el8.5.0+770+e2f49861
  • conmon Rocky Linux 8 2:2.0.15-1.module+el8.4.0+559+c02fa3b2
  • conmon Rocky Linux 8 2:2.0.15-1.module+el8.5.0+708+6758137d

rocky linux advisories RLSA-2021:0706RLSA-2021:0705RLSA-2020:3053

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-20188 updated cvss 7.0

podman: container users permissions are not respected in privileged containers

  • Red Hat OpenShift Container Platform 3.11 podman
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 Extras podman 1.6.4-29.el7_9, podman-docker 1.6.4-29.el7_9
    fixed: vendor fix RHSA-2021:0681
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.14-2.module+el8.2.1+6750+e53a300c, criu 3.14-2.module+el8.2.1+6750+e53a300c, crit 3.12-9.module+el8.3.0+10171+12421f43, crit 3.12-9.module+el8.3.0+10188+4c10031c, criu 3.12-9.module+el8.3.0+10171+12421f43, criu 3.12-9.module+el8.3.0+10188+4c10031c, +54 more
    fixed: vendor fix RHSA-2020:3053
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) crit 3.12-9.module+el8.2.0+9938+46853747, criu 3.12-9.module+el8.2.0+9938+46853747, udica 0.2.1-2.module+el8.2.0+9938+46853747, conmon 2.0.6-1.module+el8.2.0+9938+46853747, skopeo 0.1.40-9.module+el8.2.0+9938+46853747, toolbox 0.0.7-1.module+el8.2.0+9938+46853747, +16 more
    fixed: vendor fix RHSA-2021:0710
  • Red Hat Enterprise Linux 9 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +1 more Red Hat OpenShift Container Platform 4 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C
GitHub 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/containers/libpod
<1.7.0
1.7.0

Affected products

  • n/a podman

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.