A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cockpit-podmanUpgrade toolboxUpgrade python-podman-apiUpgrade fuse-overlayfsUpgrade udicaUpgrade slirp4netnsUpgrade python3-criuUpgrade criuUpgrade container-selinuxUpgrade runcUpgrade oci-systemd-hookUpgrade containernetworking-pluginsUpgrade critUpgrade oci-umount | May 13, 2022 | Mar 31, 2020 |
| Alpine Linux | — | Upgrade buildah | Aug 22, 2024 | Mar 31, 2020 |
| Centos_linux | — | Upgrade oci-systemd-hookUpgrade criuUpgrade oci-umount-debugsourceUpgrade udicaUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade podman-debugsourceUpgrade podman-remoteUpgrade podman-debuginfoUpgrade podman-dockerUpgrade python-podman-apiUpgrade skopeo-testsUpgrade runcUpgrade oci-systemd-hook-debuginfoUpgrade slirp4netns-debugsourceUpgrade python3-criuUpgrade containernetworking-plugins-debuginfoUpgrade critUpgrade oci-systemd-hook-debugsourceUpgrade podmanUpgrade podman-testsUpgrade slirp4netns-debuginfoUpgrade runc-debugsourceUpgrade criu-debugsourceUpgrade skopeo-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade cockpit-podmanUpgrade fuse-overlayfs-debuginfoUpgrade containers-commonUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfoUpgrade criu-debuginfoUpgrade runc-debuginfoUpgrade skopeo-debugsourceUpgrade fuse-overlayfsUpgrade conmonUpgrade buildah-debugsourceUpgrade skopeoUpgrade podman-remote-debuginfoUpgrade buildahUpgrade toolboxUpgrade buildah-testsUpgrade oci-umount-debuginfoUpgrade oci-umountUpgrade slirp4netns | Apr 29, 2020 | Mar 31, 2020 |
| Debian | — | Upgrade golang-github-containers-buildah | Jul 30, 2024 | Mar 31, 2020 |
| Oracle_linux | — | Upgrade critUpgrade criuUpgrade podman-remoteUpgrade oci-umountUpgrade skopeoUpgrade python3-criuUpgrade runcUpgrade oci-systemd-hookUpgrade containers-commonUpgrade skopeo-testsUpgrade podmanUpgrade containernetworking-pluginsUpgrade buildah-testsUpgrade slirp4netnsUpgrade podman-dockerUpgrade conmonUpgrade podman-testsUpgrade buildahUpgrade cockpit-podmanUpgrade container-selinuxUpgrade fuse-overlayfsUpgrade udicaUpgrade python-podman-api | Oct 5, 2022 | Mar 26, 2020 |
| Redhat Openshift | — | Upgrade ipxeUpgrade cri-toolsUpgrade python-pysocksUpgrade buildahUpgrade redhat-release-coreosUpgrade python-clickUpgrade tiniUpgrade openshift-clientsUpgrade kibanaUpgrade machine-config-daemonUpgrade dracutUpgrade python-certifiUpgrade python-pyroute2Upgrade apbUpgrade python-cachetoolsUpgrade jenkinsUpgrade fuse-overlayfsUpgrade conmonUpgrade jenkins-2-pluginsUpgrade openshift-ansibleUpgrade postgresql-apb-roleUpgrade ignitionUpgrade atomic-openshift-service-idlerUpgrade inotify-toolsUpgrade python-dictdifferUpgrade pivotUpgrade coreos-installerUpgrade libunwindUpgrade skopeoUpgrade openshiftUpgrade faqUpgrade containernetworking-pluginsUpgrade grpcUpgrade ansible-runner-httpUpgrade toolboxUpgrade python-voluptuousUpgrade python-elasticsearchUpgrade dumb-initUpgrade apb-base-scriptsUpgrade python-daemonUpgrade podmanUpgrade python-botocoreUpgrade python-sushyUpgrade python-google-authUpgrade atomic-enterprise-service-catalogUpgrade console-login-helper-messagesUpgrade rust-afterburnUpgrade python-openstacksdkUpgrade mysql-apb-roleUpgrade protobufUpgrade golang-github-prometheus-promuUpgrade openstack-ironicUpgrade python-requests-unixsocketUpgrade rhcos-toolsUpgrade rpm-ostreeUpgrade nss-altfilesUpgrade rhosp-director-imagesUpgrade libnftnlUpgrade python-s3transferUpgrade python-string_utilsUpgrade python-rsaUpgrade python-kubernetesUpgrade python-ruamel-yamlUpgrade openstack-ironic-inspectorUpgrade python-pexpectUpgrade iptablesUpgrade ansible-asb-modulesUpgrade openshift-eventrouterUpgrade ansible-kubernetes-modulesUpgrade python-netaddrUpgrade python-psutilUpgrade python-typingUpgrade python-ptyprocessUpgrade python-urllib3Upgrade elastic-curatorUpgrade openstack-ironic-python-agentUpgrade ostreeUpgrade python-ruamel-ordereddictUpgrade jqUpgrade runcUpgrade golang-scl-shimUpgrade onigurumaUpgrade ovn2.12Upgrade python-lockfileUpgrade ansible-runnerUpgrade mariadb-apb-roleUpgrade thriftUpgrade python-kuryr-libUpgrade python-boto3Upgrade systemdUpgrade python-openshiftUpgrade openshift-kuryr | Dec 29, 2020 | Mar 26, 2020 |
| Redhat_linux | — | Upgrade podman-debugsourceUpgrade skopeo-testsUpgrade slirp4netns-debugsourceUpgrade oci-systemd-hookUpgrade container-selinuxUpgrade oci-systemd-hook-debugsourceUpgrade python-podman-apiUpgrade buildah-debugsourceUpgrade podman-remoteUpgrade oci-umount-debugsourceUpgrade slirp4netnsUpgrade podman-debuginfoUpgrade slirp4netns-debuginfoUpgrade runcUpgrade podman-remote-debuginfoUpgrade critUpgrade containernetworking-plugins-debuginfoUpgrade podman-testsUpgrade containernetworking-pluginsUpgrade udicaUpgrade python3-criuUpgrade runc-debuginfoUpgrade podmanUpgrade runc-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade criu-debuginfoUpgrade conmonUpgrade skopeoUpgrade criuUpgrade skopeo-debugsourceUpgrade toolboxUpgrade cockpit-podmanUpgrade oci-systemd-hook-debuginfoUpgrade skopeo-debuginfoUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade buildah-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade oci-umount-debuginfoUpgrade buildahUpgrade oci-umountUpgrade buildah-tests-debuginfoUpgrade buildah-testsUpgrade criu-debugsourceUpgrade containers-common | Apr 29, 2020 | Mar 31, 2020 |
| Rocky_linux | — | Upgrade runc-debugsourceUpgrade oci-umount-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade oci-systemd-hookUpgrade oci-systemd-hook-debugsourceUpgrade runc-debuginfoUpgrade slirp4netns-debugsourceUpgrade slirp4netnsUpgrade oci-umount-debugsourceUpgrade slirp4netns-debuginfoUpgrade criu-debugsourceUpgrade python3-criuUpgrade buildah-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debuginfoUpgrade critUpgrade buildah-testsUpgrade oci-systemd-hook-debuginfoUpgrade oci-umountUpgrade buildahUpgrade criuUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfsUpgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade runcUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debuginfo | Mar 12, 2024 | Mar 31, 2020 |
| Suse | — | Upgrade buildahUpgrade libcontainers-commonUpgrade podmanUpgrade podman-cni-config | Dec 1, 2020 | Mar 31, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub