DEBIAN-CVE-2021-4024

    Dashboard / Vulnerabilities / DEBIAN-CVE-2021-4024

    DEBIAN-CVE-2021-4024

    Published: 23 Dec 2021Last Modified: 1 Sept 2026
    Upstream:
    CVE-2021-4024

    Summary:

    Details: A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.

    References: https://security-tracker.debian.org/tracker/CVE-2021-4024

    Affected packages

    Package

    Name: libpod

    Purl: pkg:deb/debian/libpod?arch=source&distro=bookworm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3.4.3+ds1-1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2021-4024 | CVE-DB