PT-2021-21101 · Buildah+7 · Buildah+7
Nalind
·
Published
2020-12-08
·
Updated
2024-06-15
·
CVE-2021-3602
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Buildah versions prior to 1.21.3
Description:
An information disclosure flaw was found in Buildah when building containers using chroot isolation. Running processes in container builds, such as Dockerfile RUN commands, can access environment variables from parent and grandparent processes. In a CI/CD environment, these environment variables may include sensitive information, like container registry credentials, that was shared with the container to be used only by Buildah itself.
Recommendations:
For versions prior to 1.21.3, upgrade packages or images to include version 1.21.3 or later.
As a temporary workaround, consider invoking
buildah in a container under env -i to have it started with a reinitialized environment, which should prevent the leakage.Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Buildah
Centos
Debian
Red Hat
Rocky Linux
Suse