buildah
En bref
- Source
- NVD
- EPSS
- EPSS 0.33 % · centile 26 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
- CWE-212 — Suppression incorrecte d'informations sensibles avant stockage ou transfert
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 1.9 | AV:L/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-7638-r9r3-rmjj — Buildah processes using chroot isolation may leak environment values to intermediate processes
- GO-2022-0345 — Environment variable leakage in github.com/containers/buildah
Références européennes
- ENISA EUVD · EUVD-2021-1446
- GCVE · GCVE-0-2021-3602
Configurations affectées (CPE NVD)
cpe:2.3:a:buildah_project:buildah:*:*:*:*:*:*:*:*< 1.16.8cpe:2.3:a:buildah_project:buildah:*:*:*:*:*:*:*:*≥ 1.17.0 < 1.17.2cpe:2.3:a:buildah_project:buildah:*:*:*:*:*:*:*:*≥ 1.19.0 < 1.19.9cpe:2.3:a:buildah_project:buildah:*:*:*:*:*:*:*:*≥ 1.21.0 < 1.21.3cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| buildah | affected Affects v1.21.2, v1.20.0, v1.19.8, v1.18.0, v1.17.1, v1.16.7, Fixed in v1.21.3, v1.19.9, v1.17.2, v1.16.8, v1.22.0 and above. |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |