CVE catalog

CVE-2019-18466

libpod: CVE-2019-18466

Severity: Medium · CVSS 5.5CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published: Dec 17, 2019, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.39% · Oct 25, 2026

An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a victim user to the host filesystem, may overwrite existing files with others from the host.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libpod	bookworm	`4.3.1+ds1-8+deb12u1`	not affected
Suse	cni	linux enterprise module for containers 15 sp1	`0.7.1-3.3.1`	fixed
Suse	cni-plugins	linux enterprise module for containers 15 sp1	`0.8.4-3.3.1`	fixed
Suse	conmon	linux enterprise module for containers 15 sp1	`2.0.10-3.3.1`	fixed
Suse	fuse-overlayfs	linux enterprise module for containers 15 sp1	`0.7.6-3.6.1`	fixed
Suse	podman	linux enterprise module for containers 15 sp1	`1.8.0-4.14.1`	fixed
Suse	cni	linux enterprise module for public cloud 15 sp1	`0.7.1-3.3.1`	fixed
Suse	cni-plugins	linux enterprise module for public cloud 15 sp1	`0.8.4-3.3.1`	fixed
Opensuse	cni	leap 15.1	`0.7.1-lp151.2.3.1`	fixed
Opensuse	cni-plugins	leap 15.1	`0.8.4-lp151.2.3.1`	fixed
Opensuse	conmon	leap 15.1	`2.0.10-lp151.2.1`	fixed
Opensuse	fuse-overlayfs	leap 15.1	`0.7.6-lp151.5.1`	fixed
Opensuse	podman	leap 15.1	`1.8.0-lp151.3.9.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libpod	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Suse	cni	rpm	linux enterprise module for containers 15 sp1	`0.7.1-3.3.1`	Not reported	SUSE-SU-2020:0697-1	Not reported
Suse	cni-plugins	rpm	linux enterprise module for containers 15 sp1	`0.8.4-3.3.1`	Not reported	SUSE-SU-2020:0697-1	Not reported
Suse	conmon	rpm	linux enterprise module for containers 15 sp1	`2.0.10-3.3.1`	Not reported	SUSE-SU-2020:0697-1	Not reported
Suse	fuse-overlayfs	rpm	linux enterprise module for containers 15 sp1	`0.7.6-3.6.1`	Not reported	SUSE-SU-2020:0697-1	Not reported
Suse	podman	rpm	linux enterprise module for containers 15 sp1	`1.8.0-4.14.1`	Not reported	SUSE-SU-2020:0697-1	Not reported
Suse	cni	rpm	linux enterprise module for public cloud 15 sp1	`0.7.1-3.3.1`	Not reported	SUSE-SU-2020:0697-1	Not reported
Suse	cni-plugins	rpm	linux enterprise module for public cloud 15 sp1	`0.8.4-3.3.1`	Not reported	SUSE-SU-2020:0697-1	Not reported
Opensuse	cni	rpm	leap 15.1	`0.7.1-lp151.2.3.1`	Not reported	OPENSUSE-SU-2020:0398-1	Not reported
Opensuse	cni-plugins	rpm	leap 15.1	`0.8.4-lp151.2.3.1`	Not reported	OPENSUSE-SU-2020:0398-1	Not reported
Opensuse	conmon	rpm	leap 15.1	`2.0.10-lp151.2.1`	Not reported	OPENSUSE-SU-2020:0398-1	Not reported
Opensuse	fuse-overlayfs	rpm	leap 15.1	`0.7.6-lp151.5.1`	Not reported	OPENSUSE-SU-2020:0398-1	Not reported
Opensuse	podman	rpm	leap 15.1	`1.8.0-lp151.3.9.1`	Not reported	OPENSUSE-SU-2020:0398-1	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[podman]Not affected
Source package: [libpod]
Details (2)
- 4.3.1+ds1-8+deb12u1+b3 · amd64 · bookworm
  Not affected
  dsa · libpod · debian · bookworm
- 4.3.1+ds1-8+deb12u1+b3 · arm64 · bookworm
  Not affected
  dsa · libpod · debian · bookworm
[podman-docker]Not affected
Source package: [libpod]
Details (2)
- 4.3.1+ds1-8+deb12u1+b3 · amd64 · bookworm
  Not affected
  dsa · libpod · debian · bookworm
- 4.3.1+ds1-8+deb12u1+b3 · arm64 · bookworm
  Not affected
  dsa · libpod · debian · bookworm

Observed: Oct 23, 2026, 5:42:00 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]