Skip to content
Sign in
Not rated

CVE-2021-3602 An information disclosure flaw was found in Buildah, when building containers using chroot isolation

Description

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).

Affected products and versions

Product Affected versions Fixed in
buildah Versions not published

Other CVEs of buildah

The 3 CVEs of buildah →
CVE-2022-2990 An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive… Not rated CVE-2022-27651 A flaw was found in buildah where containers were incorrectly started with non-empty default permissions Not rated
Track this CVE