CVE-2021-20199

podman: Remote traffic to rootless containers is seen as orginating from localhost

Loading…

Severity

Moderate

Red Hat Product Security

5.9

CVSS 3.1

Review impact separately from score.

Published · January 1, 2021

Updated · November 22, 2025

Description

A flaw was found in podman. Rootless containers receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts) which impact containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. The highest threat from this vulnerability is to data integrity.

Statement

This issue does not affect Podman prior to version 1.8.0. Podman shipped in the following products are therefore not affected:

Red Hat Enterprise Linux 7 Extras
Red Hat Enterprise Linux 8 Container Tools stream 1.0
Red Hat Enterprise Linux 8 Container Tools stream 2.0
OpenShift Container Platform 3.11
OpenShift Container Platform 4.1 to 4.5

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Configure containerized applications to require authentication for connections from all sources, including localhost.

CVSS / CWE

CVSS 3.1 · 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-346 · Origin Validation Error