A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-seccomp-bpf-hookUpgrade libslirpUpgrade criu-develUpgrade python3-criuUpgrade container-selinuxUpgrade criu-libsUpgrade libslirp-develUpgrade python3-podmanUpgrade containers-commonUpgrade podman-pluginsUpgrade skopeo-testsUpgrade buildahUpgrade containernetworking-pluginsUpgrade crunUpgrade podman-remoteUpgrade podman-gvproxyUpgrade podmanUpgrade critUpgrade toolboxUpgrade aardvark-dnsUpgrade cockpit-podmanUpgrade fuse-overlayfsUpgrade netavarkUpgrade conmonUpgrade slirp4netnsUpgrade runcUpgrade podman-dockerUpgrade skopeoUpgrade criuUpgrade toolbox-testsUpgrade podman-testsUpgrade podman-catatonitUpgrade udicaUpgrade buildah-tests | Oct 30, 2024 | Oct 9, 2024 |
| Alpine Linux | — | Upgrade podmanUpgrade buildah | Aug 8, 2025 | Oct 9, 2024 |
| Debian | — | Upgrade golang-github-containers-buildah | May 15, 2025 | Oct 9, 2024 |
| Oracle_linux | — | Upgrade slirp4netnsUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade criuUpgrade netavarkUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade podman-remoteUpgrade python3-podmanUpgrade buildah-testsUpgrade buildahUpgrade podmanUpgrade cockpit-podmanUpgrade podman-dockerUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade container-selinuxUpgrade podman-testsUpgrade criu-develUpgrade conmonUpgrade criu-libsUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade podman-pluginsUpgrade crunUpgrade runcUpgrade skopeo-testsUpgrade critUpgrade libslirp-develUpgrade libslirp | Nov 11, 2024 | Oct 9, 2024 |
| Redhat Openshift | — | Upgrade podman | Nov 7, 2024 | Oct 9, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Oct 31, 2024 | Oct 9, 2024 |
| Rocky_linux | — | Upgrade conmon-debugsourceUpgrade runcUpgrade toolbox-testsUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-pluginsUpgrade podman-debuginfoUpgrade podman-remote-debuginfoUpgrade libslirp-debuginfoUpgrade containers-commonUpgrade criu-debugsourceUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade critUpgrade podman-pluginsUpgrade netavarkUpgrade skopeoUpgrade criuUpgrade crun-debugsourceUpgrade podman-catatonitUpgrade podman-remoteUpgrade fuse-overlayfs-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade podmanUpgrade podman-catatonit-debuginfoUpgrade toolboxUpgrade toolbox-debuginfoUpgrade toolbox-debugsourceUpgrade buildah-debugsourceUpgrade slirp4netns-debugsourceUpgrade crun-debuginfoUpgrade libslirp-debugsourceUpgrade buildah-testsUpgrade conmon-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade libslirp-develUpgrade slirp4netns-debuginfoUpgrade runc-debuginfoUpgrade crunUpgrade slirp4netnsUpgrade runc-debugsourceUpgrade criu-develUpgrade aardvark-dnsUpgrade podman-debugsourceUpgrade criu-libsUpgrade criu-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade conmonUpgrade buildahUpgrade libslirpUpgrade skopeo-testsUpgrade python3-criuUpgrade podman-testsUpgrade podman-plugins-debuginfoUpgrade podman-gvproxyUpgrade buildah-tests-debuginfo | Nov 19, 2024 | Oct 9, 2024 |
| Suse | — | Upgrade buildahUpgrade govulncheck-vulndbUpgrade podmanshUpgrade podmanUpgrade podman-remoteUpgrade podman-docker | Dec 31, 2024 | Oct 9, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub