Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-3602

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).

Published

2022-03-03T19:15:08.107

Last Modified

2024-11-21T06:21:57.180

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.5 (MEDIUM)

CVSSv2 Vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

  • Access Vector: LOCAL
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

3.4

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-200
  • Type: Primary
    CWE-212
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application buildah_project buildah < 1.16.8 Yes
Application buildah_project buildah < 1.17.2 Yes
Application buildah_project buildah < 1.19.9 Yes
Application buildah_project buildah < 1.21.3 Yes
Operating System redhat enterprise_linux 8.0 Yes
Operating System redhat enterprise_linux_for_ibm_z_systems 8.0 Yes
Operating System redhat enterprise_linux_for_power_little_endian 8.0 Yes
References