CVE-2021-3602
Medium
Description
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
SeverityMedium
CVSS5.5
Exploit probability—
Product
Buildah
PublishedMar 3, 2022
First seenMar 3, 2022
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- buildah_project buildah1.16.8, 1.17.2, 1.19.9, 1.21.3 or later
- github.com/containers/buildah1.16.8, 1.17.2, 1.19.9, 1.21.3, 1.22.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| buildah_project buildah | v < 1.16.8, 1.17.0 ≤ v < 1.17.2, 1.19.0 ≤ v < 1.19.9, 1.21.0 ≤ v < 1.21.3 | 1.16.8, 1.17.2, 1.19.9, 1.21.3 |
| redhat enterprise_linux | 8.0 | — |
| redhat enterprise_linux_for_ibm_z_systems | 8.0 | — |
| redhat enterprise_linux_for_power_little_endian | 8.0 | — |
| github.com/containers/buildahGo | v < 1.16.8, 1.17.0 ≤ v < 1.17.2, 1.18.0 ≤ v < 1.19.9, 1.20.0 ≤ v < 1.21.3, v < 1.22.0 | 1.16.8, 1.17.2, 1.19.9, 1.21.3, 1.22.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.