← Back to CVEs
CVE-2021-3602
MEDIUM5.5
Description
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
CVE Details
CVSS v3.1 Score5.5
SeverityMEDIUM
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack VectorLOCAL
ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
Published3/3/2022
Last Modified11/21/2024
Sourcenvd
Honeypot Sightings0
Affected Products
buildah_project:buildahredhat:enterprise_linuxredhat:enterprise_linux_for_ibm_z_systemsredhat:enterprise_linux_for_power_little_endian
Weaknesses (CWE)
CWE-200CWE-212
References
https://bugzilla.redhat.com/show_bug.cgi?id=1969264(secalert@redhat.com)
https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0(secalert@redhat.com)
https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjj(secalert@redhat.com)
https://ubuntu.com/security/CVE-2021-3602(secalert@redhat.com)
https://bugzilla.redhat.com/show_bug.cgi?id=1969264(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjj(af854a3a-2127-422b-91ae-364da2661108)
https://ubuntu.com/security/CVE-2021-3602(af854a3a-2127-422b-91ae-364da2661108)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.