A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade toolboxUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade python-podman-apiUpgrade udicaUpgrade fuse-overlayfsUpgrade criuUpgrade oci-umountUpgrade python3-criuUpgrade critUpgrade oci-systemd-hookUpgrade runcUpgrade container-selinuxUpgrade containernetworking-plugins | May 13, 2022 | Mar 31, 2020 |
| Alpine Linux | — | Upgrade buildah | Aug 22, 2024 | Mar 31, 2020 |
| Centos_linux | — | Upgrade conmonUpgrade buildahUpgrade fuse-overlayfsUpgrade buildah-debugsourceUpgrade buildah-debuginfoUpgrade oci-umount-debuginfoUpgrade podman-remote-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-debuginfoUpgrade toolboxUpgrade cockpit-podmanUpgrade skopeo-debugsourceUpgrade runc-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade criu-debugsourceUpgrade runc-debugsourceUpgrade containers-commonUpgrade slirp4netnsUpgrade criu-debuginfoUpgrade skopeoUpgrade buildah-testsUpgrade oci-umountUpgrade buildah-tests-debuginfoUpgrade python-podman-apiUpgrade container-selinuxUpgrade oci-systemd-hookUpgrade criuUpgrade podman-debugsourceUpgrade podman-dockerUpgrade podmanUpgrade oci-systemd-hook-debuginfoUpgrade oci-umount-debugsourceUpgrade containernetworking-pluginsUpgrade runcUpgrade udicaUpgrade podman-testsUpgrade podman-debuginfoUpgrade skopeo-testsUpgrade oci-systemd-hook-debugsourceUpgrade slirp4netns-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-remoteUpgrade python3-criuUpgrade critUpgrade containernetworking-plugins-debuginfo | Apr 29, 2020 | Mar 31, 2020 |
| Debian | — | Upgrade golang-github-containers-buildah | Jul 30, 2024 | Mar 31, 2020 |
| Oracle_linux | — | Upgrade conmonUpgrade podman-testsUpgrade buildahUpgrade fuse-overlayfsUpgrade slirp4netnsUpgrade podman-dockerUpgrade buildah-testsUpgrade udicaUpgrade cockpit-podmanUpgrade python-podman-apiUpgrade container-selinuxUpgrade skopeo-testsUpgrade containernetworking-pluginsUpgrade oci-umountUpgrade podman-remoteUpgrade criuUpgrade podmanUpgrade containers-commonUpgrade oci-systemd-hookUpgrade python3-criuUpgrade skopeoUpgrade critUpgrade runc | Oct 5, 2022 | Mar 26, 2020 |
| Redhat Openshift | — | Upgrade python-kubernetesUpgrade ansible-kubernetes-modulesUpgrade python-ruamel-yamlUpgrade thriftUpgrade python-ptyprocessUpgrade systemdUpgrade python-psutilUpgrade python-boto3Upgrade python-rsaUpgrade python-openshiftUpgrade nss-altfilesUpgrade python-string_utilsUpgrade onigurumaUpgrade runcUpgrade openstack-ironic-inspectorUpgrade python-kuryr-libUpgrade ovn2.12Upgrade golang-scl-shimUpgrade python-ruamel-ordereddictUpgrade python-typingUpgrade openshift-kuryrUpgrade mariadb-apb-roleUpgrade golang-github-prometheus-promuUpgrade rhcos-toolsUpgrade python-s3transferUpgrade python-pexpectUpgrade iptablesUpgrade ostreeUpgrade ansible-asb-modulesUpgrade jqUpgrade openstack-ironic-python-agentUpgrade rpm-ostreeUpgrade libnftnlUpgrade elastic-curatorUpgrade openstack-ironicUpgrade ansible-runnerUpgrade openshift-eventrouterUpgrade python-urllib3Upgrade python-requests-unixsocketUpgrade rhosp-director-imagesUpgrade python-netaddrUpgrade python-lockfileUpgrade python-clickUpgrade python-pyroute2Upgrade python-sushyUpgrade protobufUpgrade python-google-authUpgrade faqUpgrade dracutUpgrade python-cachetoolsUpgrade python-openstacksdkUpgrade rust-afterburnUpgrade jenkins-2-pluginsUpgrade jenkinsUpgrade kibanaUpgrade python-pysocksUpgrade pivotUpgrade openshiftUpgrade toolboxUpgrade podmanUpgrade ansible-runner-httpUpgrade tiniUpgrade python-voluptuousUpgrade grpcUpgrade python-elasticsearchUpgrade python-daemonUpgrade conmonUpgrade python-botocoreUpgrade atomic-openshift-service-idlerUpgrade apbUpgrade dumb-initUpgrade libunwindUpgrade apb-base-scriptsUpgrade mysql-apb-roleUpgrade coreos-installerUpgrade python-certifiUpgrade ipxeUpgrade machine-config-daemonUpgrade inotify-toolsUpgrade buildahUpgrade ignitionUpgrade redhat-release-coreosUpgrade containernetworking-pluginsUpgrade skopeoUpgrade openshift-ansibleUpgrade console-login-helper-messagesUpgrade cri-toolsUpgrade fuse-overlayfsUpgrade postgresql-apb-roleUpgrade atomic-enterprise-service-catalogUpgrade python-dictdifferUpgrade openshift-clients | Dec 29, 2020 | Mar 26, 2020 |
| Redhat_linux | — | Upgrade containernetworking-pluginsUpgrade slirp4netns-debugsourceUpgrade slirp4netns-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade buildah-debugsourceUpgrade skopeo-testsUpgrade runcUpgrade slirp4netnsUpgrade oci-umount-debugsourceUpgrade udicaUpgrade podman-debuginfoUpgrade critUpgrade containernetworking-plugins-debuginfoUpgrade runc-debuginfoUpgrade oci-systemd-hookUpgrade python3-criuUpgrade podman-remote-debuginfoUpgrade podman-remoteUpgrade container-selinuxUpgrade podman-debugsourceUpgrade python-podman-apiUpgrade podman-testsUpgrade fuse-overlayfs-debuginfoUpgrade criu-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfsUpgrade oci-systemd-hook-debuginfoUpgrade podman-dockerUpgrade skopeo-debuginfoUpgrade cockpit-podmanUpgrade buildahUpgrade buildah-debuginfoUpgrade skopeoUpgrade toolboxUpgrade oci-umountUpgrade oci-umount-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildah-testsUpgrade criu-debugsourceUpgrade containers-commonUpgrade runc-debugsourceUpgrade podmanUpgrade criuUpgrade buildah-tests-debuginfoUpgrade skopeo-debugsourceUpgrade conmon | Apr 29, 2020 | Mar 31, 2020 |
| Rocky_linux | — | Upgrade criu-debugsourceUpgrade oci-umount-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netnsUpgrade slirp4netns-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade oci-umount-debugsourceUpgrade slirp4netns-debuginfoUpgrade runc-debuginfoUpgrade python3-criuUpgrade oci-systemd-hookUpgrade runc-debugsourceUpgrade containernetworking-pluginsUpgrade fuse-overlayfsUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debugsourceUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade critUpgrade buildah-testsUpgrade buildah-tests-debuginfoUpgrade runcUpgrade criu-debuginfoUpgrade buildahUpgrade criuUpgrade oci-umountUpgrade oci-systemd-hook-debuginfoUpgrade fuse-overlayfs-debuginfo | Mar 12, 2024 | Mar 31, 2020 |
| Suse | — | Upgrade buildahUpgrade libcontainers-commonUpgrade podman-cni-configUpgrade podman | Dec 1, 2020 | Mar 31, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub