CVE catalog

CVE-2021-4024

libpod: CVE-2021-4024

Severity: Medium · CVSS 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Published: Dec 23, 2021, 8:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.14% · Oct 25, 2026

A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libpod	bookworm	`4.3.1+ds1-8+deb12u1`	fixed
Ubuntu	libpod	pro	`4.3.1+ds1-8`	vulnerable
Ubuntu	libpod	pro	`4.7.2+ds1-2`	vulnerable
Ubuntu	libpod	pro	`4.7.2+ds1-2build1`	vulnerable
Ubuntu	libpod	pro	`4.8.3+ds1-2`	vulnerable
Ubuntu	libpod	pro	`4.9.0+ds1-2`	vulnerable
Ubuntu	libpod	pro	`4.9.3+ds1-1`	vulnerable
Ubuntu	libpod	pro	`4.9.3+ds1-1build1`	vulnerable
Ubuntu	libpod	pro	`4.9.3+ds1-1build2`	vulnerable
Ubuntu	libpod	pro	`4.9.3+ds1-1ubuntu0.1`	vulnerable
Ubuntu	libpod	pro	`4.9.3+ds1-1ubuntu0.2`	vulnerable
Ubuntu	libpod	pro	`4.9.3+ds1-1ubuntu0.2+esm1`	vulnerable
Ubuntu	libpod	pro	`4.9.3+ds1-1ubuntu0.2+esm2`	vulnerable
Ubuntu	libpod	pro	`4.9.3+ds1-1ubuntu0.2+esm3`	vulnerable
Opensuse	podman	tumbleweed	`3.4.4-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libpod	source	bookworm	`3.4.3+ds1-1`	not yet assigned	Not reported	[1000844]
Opensuse	podman	rpm	tumbleweed	`3.4.4-1.1`	Not reported	OPENSUSE-SU-2024:11674-1	Not reported

[Debian bug #1000844]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[podman-docker]Unknown
Source package: [podman]
Details (1)
- 6.0.2-1.1 · noarch · tumbleweed
  Unknown · Fixed: 3.4.4-1.1
  Version impact unknown
  dsa · podman · opensuse · tumbleweed
[podman-remote]Unknown
Source package: [podman]
Details (1)
- 6.0.2-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.4.4-1.1
  Version impact unknown
  dsa · podman · opensuse · tumbleweed
[podmansh]Unknown
Source package: [podman]
Details (1)
- 6.0.2-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.4.4-1.1
  Version impact unknown
  dsa · podman · opensuse · tumbleweed
[podman]Fixed
Source package: [podman]
Details (1)
- 6.0.2-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 3.4.4-1.1
  dsa · podman · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[podman]Fixed
Source package: [libpod]
Details (2)
- 4.3.1+ds1-8+deb12u1+b3 · amd64 · bookworm
  Fixed · Fixed: 3.4.3+ds1-1
  dsa · libpod · debian · bookworm; dsa · libpod · debian · 12
- 4.3.1+ds1-8+deb12u1+b3 · arm64 · bookworm
  Fixed · Fixed: 3.4.3+ds1-1
  dsa · libpod · debian · bookworm; dsa · libpod · debian · 12
[podman-docker]Fixed
Source package: [libpod]
Details (2)
- 4.3.1+ds1-8+deb12u1+b3 · amd64 · bookworm
  Fixed · Fixed: 3.4.3+ds1-1
  dsa · libpod · debian · bookworm; dsa · libpod · debian · 12
- 4.3.1+ds1-8+deb12u1+b3 · arm64 · bookworm
  Fixed · Fixed: 3.4.3+ds1-1
  dsa · libpod · debian · bookworm; dsa · libpod · debian · 12

Observed: Oct 23, 2026, 6:02:22 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]