CVE-2021-20199

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-346

Affected software

Vendor	Product	Versions
n/a	podman	podman 1.8.0 onwards

References

https://bugzilla.redhat.com/show_bug.cgi?id=1919050Issue Tracking, Third Party Advisory
https://github.com/containers/podman/issues/5138Exploit, Third Party Advisory
https://github.com/containers/podman/pull/9052Patch, Third Party Advisory
https://github.com/rootless-containers/rootlesskit/pull/206Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1919050Issue Tracking, Third Party Advisory
https://github.com/containers/podman/issues/5138Exploit, Third Party Advisory
https://github.com/containers/podman/pull/9052Patch, Third Party Advisory
https://github.com/rootless-containers/rootlesskit/pull/206Patch, Third Party Advisory

Timeline

Published: Feb 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-20206.5Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 an CVE-2021-202015.3A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service (CPU CVE-2021-202027.3A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider CVE-2021-202033.2An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply CVE-2021-202049.8A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databas CVE-2021-202056.5Libjpeg-turbo versions 2.0.91 and 2.0.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a cra CVE-2021-202067.2An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load i CVE-2021-202086.1A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerbero CVE-2021-202097.5A memory leak vulnerability was found in Privoxy before 3.0.29 in the show-status CGI handler when no action files are configured.CVE-2021-20214.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 an CVE-2021-202107.5A flaw was found in Privoxy in versions before 3.0.29. Memory leak in the show-status CGI handler when no filter files are configured can le CVE-2021-202117.5A flaw was found in Privoxy in versions before 3.0.29. Memory leak when client tags are active can cause a system crash.