Incorrect Authorization Affecting slirp4netns-debuginfo package, versions <0:0.4.2-3.git21fdece.module+el8.5.0+708+6758137d


Severity

Recommended
0.0
high
0
10

Based on Rocky Linux security rating.

Threat Intelligence

EPSS
0.04% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Incorrect Authorization vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-ROCKY8-SLIRP4NETNSDEBUGINFO-3295272
  • published5 Jan 2023
  • disclosed11 Feb 2021

Introduced: 11 Feb 2021

CVE-2021-20188  (opens in a new tab)
CWE-863  (opens in a new tab)

How to fix?

Upgrade Rocky-Linux:8 slirp4netns-debuginfo to version 0:0.4.2-3.git21fdece.module+el8.5.0+708+6758137d or higher.
This issue was patched in RLSA-2021:0706.

NVD Description

Note: Versions mentioned in the description apply only to the upstream slirp4netns-debuginfo package and not the slirp4netns-debuginfo package as distributed by Rocky-Linux. See How to fix? for Rocky-Linux:8 relevant fixed versions and status.

A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS Scores

version 3.1