CVE-2018-10856

State: Published
Severity: 5.3 Medium
Published: Jul 2, 2018
Updated: Aug 5, 2024
Reserved: May 9, 2018

Description

It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.

Scores

CVSS	Score	Vector	Source
3.0	5.3 Medium	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	redhat

Weaknesses

CWE-250

Affected Products

Product	Versions
podman[UNKNOWN]	podman 0.6.1Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10856
https://github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24
RHSA-2018:2037vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.