CVE-2021-4024

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2021-4024

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-4024.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-4024

Aliases

Related

Published

2021-12-23T20:15:12Z

Modified

2024-09-22T22:00:05Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVSS Calculator

Summary

[none]

Details

A flaw was found in podman. The podman machine function (used to create and manage Podman virtual machine containing a Podman process) spawns a gvproxy process on the host system. The gvproxy API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the gvproxy API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.

References

Affected packages

Debian:12 / libpod

Package

Name: libpod
Purl: pkg:deb/debian/libpod?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.4.3+ds1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/containers/podman

Affected ranges

Type: GIT
Repo: https://github.com/containers/podman
Events: Introduced

98f252a3a1a8f1ee00f9f96c6ba00500954b5093

Fixed

3450a60d2196cc0bee8a3fc28a7c93a7370d4515