CVE-2021-3602
buildah
MEDIUM 5.5
At a glance
- Source
- NVD
- EPSS
- EPSS 0.33 % · percentile 26 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
- CWE-212 — Improper Removal of Sensitive Information Before Storage or Transfer
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 1.9 | AV:L/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-7638-r9r3-rmjj — Buildah processes using chroot isolation may leak environment values to intermediate processes
- GO-2022-0345 — Environment variable leakage in github.com/containers/buildah
European references
- ENISA EUVD · EUVD-2021-1446
- GCVE · GCVE-0-2021-3602
Affected configurations (NVD CPE)
cpe:2.3:a:buildah_project:buildah:*:*:*:*:*:*:*:*< 1.16.8cpe:2.3:a:buildah_project:buildah:*:*:*:*:*:*:*:*≥ 1.17.0 < 1.17.2cpe:2.3:a:buildah_project:buildah:*:*:*:*:*:*:*:*≥ 1.19.0 < 1.19.9cpe:2.3:a:buildah_project:buildah:*:*:*:*:*:*:*:*≥ 1.21.0 < 1.21.3cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| buildah | affected Affects v1.21.2, v1.20.0, v1.19.8, v1.18.0, v1.17.1, v1.16.7, Fixed in v1.21.3, v1.19.9, v1.17.2, v1.16.8, v1.22.0 and above. |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |