PT-2022-25736 · Buildah+3 · Buildah+3

Sage Mctaggart · Published 2022-11-22 · Updated 2025-04-22 · CVE-2022-4122

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions buildah (affected versions not specified)

Description A vulnerability was found in buildah, where incorrect following of symlinks while reading .containerignore and .dockerignore files results in information disclosure. This issue affects buildah as part of Podman.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

AZL-44526

BDU:2025-12234

CVE-2022-4122

GHSA-4CRW-W8PW-2HMF

GO-2022-1151

INFSA-2024_9102

RHSA-2024:2077

RHSA-2024:9102

RHSA-2024_9102

RLSA-2024:9102

Affected Products

Debian

Red Hat

Rocky Linux

Buildah

References · 25

• https://github.com/containers/podman/pull/16315 · Patch
• https://bdu.fstec.ru/vul/2025-12234 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-4122 · Security Note
• https://ubuntu.com/security/CVE-2022-4122 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-4122 · Security Note
• https://linux.oracle.com/errata/ELSA-2024-9102.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4crw-w8pw-2hmf · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2024:9102 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44526 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1151 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-4122 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-4122 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-4122 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4122 · Vendor Advisory