A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade criuUpgrade oci-systemd-hookUpgrade python3-criuUpgrade critUpgrade container-selinuxUpgrade runcUpgrade containernetworking-pluginsUpgrade oci-umountUpgrade udicaUpgrade toolboxUpgrade cockpit-podmanUpgrade python-podman-apiUpgrade slirp4netnsUpgrade fuse-overlayfs | May 13, 2022 | Mar 31, 2020 |
| Alpine Linux | — | Upgrade buildah | Aug 22, 2024 | Mar 31, 2020 |
| Centos_linux | — | Upgrade podman-testsUpgrade slirp4netns-debugsourceUpgrade udicaUpgrade podmanUpgrade oci-systemd-hook-debugsourceUpgrade oci-umount-debugsourceUpgrade podman-debuginfoUpgrade podman-remoteUpgrade skopeo-testsUpgrade critUpgrade oci-systemd-hook-debuginfoUpgrade python3-criuUpgrade podman-dockerUpgrade oci-systemd-hookUpgrade slirp4netns-debuginfoUpgrade podman-debugsourceUpgrade container-selinuxUpgrade criuUpgrade containernetworking-pluginsUpgrade python-podman-apiUpgrade runcUpgrade containernetworking-plugins-debuginfoUpgrade buildah-testsUpgrade buildahUpgrade podman-remote-debuginfoUpgrade skopeo-debuginfoUpgrade runc-debuginfoUpgrade oci-umountUpgrade buildah-debuginfoUpgrade fuse-overlayfsUpgrade containers-commonUpgrade buildah-debugsourceUpgrade skopeo-debugsourceUpgrade criu-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade runc-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade criu-debugsourceUpgrade slirp4netnsUpgrade buildah-tests-debuginfoUpgrade conmonUpgrade oci-umount-debuginfoUpgrade skopeoUpgrade containernetworking-plugins-debugsourceUpgrade cockpit-podmanUpgrade toolbox | Apr 29, 2020 | Mar 31, 2020 |
| Debian | — | Upgrade golang-github-containers-buildah | Jul 30, 2024 | Mar 31, 2020 |
| Oracle_linux | — | Upgrade containernetworking-pluginsUpgrade skopeo-testsUpgrade podmanUpgrade skopeoUpgrade oci-systemd-hookUpgrade podman-remoteUpgrade critUpgrade oci-umountUpgrade containers-commonUpgrade criuUpgrade python3-criuUpgrade runcUpgrade container-selinuxUpgrade slirp4netnsUpgrade python-podman-apiUpgrade udicaUpgrade fuse-overlayfsUpgrade podman-testsUpgrade conmonUpgrade buildahUpgrade podman-dockerUpgrade cockpit-podmanUpgrade buildah-tests | Oct 5, 2022 | Mar 26, 2020 |
| Redhat Openshift | — | Upgrade podman | Dec 29, 2020 | Mar 31, 2020 |
| Redhat_linux | — | Upgrade containers-commonUpgrade fuse-overlayfsUpgrade criu-debuginfoUpgrade oci-systemd-hook-debuginfoUpgrade criu-debugsourceUpgrade buildah-tests-debuginfoUpgrade skopeo-debuginfoUpgrade skopeoUpgrade buildah-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade oci-umount-debuginfoUpgrade podman-dockerUpgrade cockpit-podmanUpgrade buildahUpgrade fuse-overlayfs-debuginfoUpgrade runc-debugsourceUpgrade toolboxUpgrade podmanUpgrade skopeo-debugsourceUpgrade criuUpgrade conmonUpgrade oci-umountUpgrade buildah-testsUpgrade fuse-overlayfs-debugsourceUpgrade podman-debuginfoUpgrade container-selinuxUpgrade critUpgrade podman-remoteUpgrade python3-criuUpgrade buildah-debugsourceUpgrade udicaUpgrade containernetworking-plugins-debuginfoUpgrade skopeo-testsUpgrade podman-debugsourceUpgrade slirp4netnsUpgrade slirp4netns-debugsourceUpgrade podman-testsUpgrade python-podman-apiUpgrade oci-systemd-hookUpgrade runcUpgrade oci-umount-debugsourceUpgrade runc-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade containernetworking-pluginsUpgrade slirp4netns-debuginfoUpgrade podman-remote-debuginfo | Apr 29, 2020 | Mar 31, 2020 |
| Rocky_linux | — | Upgrade slirp4netnsUpgrade runc-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade oci-umount-debuginfoUpgrade criu-debugsourceUpgrade slirp4netns-debugsourceUpgrade oci-systemd-hookUpgrade runc-debuginfoUpgrade oci-umount-debugsourceUpgrade slirp4netns-debuginfoUpgrade python3-criuUpgrade criuUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debugsourceUpgrade buildah-debuginfoUpgrade runcUpgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade oci-umountUpgrade oci-systemd-hook-debuginfoUpgrade critUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfsUpgrade buildah-testsUpgrade buildah | Mar 12, 2024 | Mar 31, 2020 |
| Suse | — | Upgrade podmanUpgrade podman-cni-configUpgrade libcontainers-commonUpgrade buildah | Dec 1, 2020 | Mar 31, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub