This vulnerability in podman arises from improper limitation of pathnames to restricted directories, enabling a path traversal attack. Specifically, when the 'kube play' command is used with a kube file container that mounts a Secret or ConfigMap volume containing a symbolic link to a host file, an attacker can overwrite host files. The vulnerability does not allow control over the content written, only the target file. It affects podman starting from version 4.0.0 and is fixed in version 5.6.1. Red Hat's advisories for OpenShift Container Platform 4.18 and 4.19 include updated packages to address this issue.

An attacker with privileges to execute the 'kube play' command can overwrite arbitrary files on the host system if the container mounts a Secret or ConfigMap volume with symbolic links to host paths. This can lead to integrity violations and potential denial of service. Confidentiality is not impacted as the attacker cannot control the content written. The CVSS v3.1 score is 8.1 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity and availability impacts.

Red Hat has released official fixes in updated packages for OpenShift Container Platform versions 4.18.24 and 4.19.12, which include patched podman versions. Users should upgrade to these fixed versions or later to remediate the vulnerability. The vendor advisory does not indicate any temporary workarounds or no-action-required status. Patch status is confirmed by Red Hat advisories. Follow Red Hat's documented upgrade procedures to fully apply the fixes.