Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/containers/buildah >= 1.38.1, < 1.43.2
Fixed in
1.43.2· Vendor fix available
Issue
Impact When processing a build contexts or add/copy instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build. Patches Fixed in Buildah 1.44 and 1.43.2.
Recommended action: Upgrade to 1.43.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact With careful use of the --mount flag in RUN instructions in Containerfiles, and by using either multi-stage builds with use of concurrently-executing build stages (e.g., using the --jobs CLI flag) or multiple separate but concurrently-executing builds, a malicious Containerfile can be used to expose content from the build host to the command being run using the RUN instruction. This can be used to read or write contents using the privileges of the process which is performing the build. When that process is a root-owned podman system service which is provided for use by unprivileged users, this includes the ability to read and write contents which the client should not be allowed to read and write, including setuid executables in locations where they can be later accessed by unprivileged users. Patches Patches have been merged to the main branch, and will be added to upcoming releases on the release-1.38, release-1.37, release-1.35, and release-1.33 branches. This addressed a…
Recommended action: Upgrade to 1.38.1, 1.37.6, 1.35.5 or 1.33.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.
Recommended action: Upgrade to 1.38.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
Recommended action: Upgrade to 1.37.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
1.35.11.24.71.31.51.32.31.29.31.34.31.33.71.27.4· Vendor fix available
Issue
Impact What kind of vulnerability is it? Who is impacted? Users running containers with root privileges allowing a container to run with read/write access to the host system files when selinux is not enabled. With selinux enabled, some read access is allowed. Patches From @nalind Reproducer Prior to testing, as root, add a memorable username to /etc/passwd via adduser or your favorite editor. Also create a memorably named file in /. Suggest: touch /SHOULDNTSEETHIS.txt and adduser SHOULDNTSEETHIS. After testing, remember to remove both the file and the user from your system. Use the following Containerfile To Test Testing with an older version of Buildah with the issue As part of the printout from the build, you should be able to see the contents of the /' and /etc directories, including the /SHOULDNOTSEETHIS.txt file that you created, and the contents of the /etc/passwd file which will include the SHOULDNOTSEETHIS user that you created. In addition, the file /BINDBREAKOUT and…
Recommended action: Upgrade to 1.35.1, 1.34.3, 1.33.7 or 5 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
Recommended action: Upgrade to 1.27.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A bug was found in Buildah where containers were created with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set.
Recommended action: Upgrade to 1.25.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When running processes using "chroot" isolation, the process being run can examine the environment variables of its immediate parent and grandparent processes (CVE-2021-3602). This isolation type is often used when running buildah in unprivileged containers, and it is often used to do so in CI/CD environments. If sensitive information is exposed to the original buildah process through its environment, that information will unintentionally be shared with child processes which it starts as part of handling RUN instructions or during buildah run. The commands that buildah is instructed to run can read that information if they choose to. Patches Users should upgrade packages, or images which contain packages, to include version 1.21.3 or later. Workarounds As a workaround, invoking buildah in a container under env -i to have it started with a reinitialized environment should prevent the leakage. For more information If you have any questions or comments about this advisory: Open…
Recommended action: Upgrade to 1.21.3, 1.19.9, 1.17.2 or 1.16.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions. Specific Go Packages Affected github.com/containers/buildah/imagebuildah
Recommended action: Upgrade to 1.14.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.