CVE-2021-3602

Published: 3 March 2022

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).

Priority

Cvss 3 Severity Score

5.5

Score breakdown

Status

Package	Release	Status
golang-github-containers-buildah Launchpad, Ubuntu, Debian	jammy	Needed
	lunar	Needed
	bionic	Does not exist
	focal	Does not exist
	groovy	Ignored (end of life)
	trusty	Does not exist
	upstream	Needs triage
	xenial	Ignored (end of standard support)
	hirsute	Ignored (end of life)
	kinetic	Ignored (end of life, was needed)
	impish	Ignored (end of life)
	mantic	Needed

Severity score breakdown

Parameter	Value
Base score	5.5
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›