buildah
7 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-11218 | < 1.33.12 ; 1.35.0 – < 1.35.5 ; 1.37.0 – < 1.37.6 ; … | Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile | HIGH 8.6 | 0.4 % | ||
| CVE-2024-9675 | < 1.38.0 | Buildah: buildah allows arbitrary directory mount | HIGH 7.8 | 0.4 % | ||
| CVE-2024-9407 | < 1.37.4 | Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction | MEDIUM 4.7 | 0.3 % | ||
| CVE-2024-1753 | 4.15.0 | Buildah: buildah: container escape via improper bind mount validation | HIGH 8.6 | 0.5 % | ||
| CVE-2022-2990 | no fixed version known | An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or poss | HIGH 7.1 | 0.3 % | ||
| CVE-2022-27651 | Affects buildah v1.24.0 and prior, Fixed in - v1.25.0 | A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker En | MEDIUM 6.8 | 1.3 % | ||
| CVE-2021-3602 | Affects v1.21.2, v1.20.0, v1.19.8, v1.18.0, v1.17.1, v1.16.7, Fixed in v1.21.3, v1.19.9, v1.17.2, v1.16.8, v1.22.0 and above. | An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds | MEDIUM 5.5 | 0.3 % |