CVE-2023-0778

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
n/a	podman	unknown

References

https://bugzilla.redhat.com/show_bug.cgi?id=2168256Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2168256Issue Tracking, Third Party Advisory

Timeline

Published: Mar 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-07797.7At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, fur CVE-2023-07805.4Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.CVE-2023-07819.8A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects the CVE-2023-07829.8A vulnerability was found in Tenda AC23 16.03.07.45 and classified as critical. Affected by this issue is the function formSetSysToolDDNS/fo CVE-2023-07839.8A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file /ecshop/admin/templa CVE-2023-07849.8A vulnerability classified as critical has been found in SourceCodester Best Online News Portal 1.0. Affected is an unknown function of the CVE-2023-07853.7A vulnerability classified as problematic was found in SourceCodester Best Online News Portal 1.0. Affected by this vulnerability is an unkn CVE-2023-07864.8Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-07875.4Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-07889.8Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-07899.8Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-07908.8Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.