CVE-2020-10696
High
Description
A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Buildah
PublishedMar 31, 2020
First seenMar 31, 2020
Weakness typeCWE-22Path traversal
How to fix
Update
- buildah_project buildah1.14.5 or later
- github.com/containers/buildah1.14.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| buildah_project buildah | v < 1.14.5 | 1.14.5 |
| redhat openshift_container_platform | 3.11 | — |
| redhat enterprise_linux | 7.0, 8.0 | — |
| github.com/containers/buildahGo | v < 1.14.4 | 1.14.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.