CVE-2018-10856: Incorrect Permission Assignment for Critical Resource

May 13, 2022 (updated July 21, 2023)

It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.

References

access.redhat.com/errata/RHSA-2018:2037
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10856
github.com/advisories/GHSA-wp7w-vx86-vj9h
github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24
nvd.nist.gov/vuln/detail/CVE-2018-10856

Code Behaviors & Features

Detect and mitigate CVE-2018-10856 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →