CVEvulnerability

CVE-2021-3602

5.5 MEDIUM Published 2022-03-03 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-03-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
1.9 LOW — AV:L/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200, CWE-212

Description

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).

Affected configurations

• buildah project buildah (< 1.16.8) • buildah project buildah (>= 1.17.0 < 1.17.2) • buildah project buildah (>= 1.19.0 < 1.19.9) • buildah project buildah (>= 1.21.0 < 1.21.3) • redhat enterprise linux 8.0 • redhat enterprise linux for ibm z systems 8.0 • redhat enterprise linux for power little endian 8.0

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer weakness

References