CVE-2020-1726

Name	CVE-2020-1726
Description	A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	961421

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libpod (PTS)	bullseye	3.0.1+dfsg1-3+deb11u5	fixed
	bookworm	4.3.1+ds1-8	fixed
	trixie	4.9.3+ds1-1	fixed
	sid	4.9.4+ds1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libpod	source	(unstable)	1.6.4+dfsg1-3			961421

Notes

Introduced in: https://github.com/containers/libpod/commit/997c4b56ed2121726e966afe9a102ed16ba78f93 (v1.6.0-rc1)
https://github.com/containers/libpod/pull/5168
Fixed by: https://github.com/containers/libpod/commit/c140ecdc9b416ab4efd4d21d14acd63b6adbdd42 (v1.8.1-rc1)