An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
| Link | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1969264 | issue tracking third party advisory patch |
| https://ubuntu.com/security/CVE-2021-3602 | third party advisory patch |
| https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjj | third party advisory |
| https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0 | third party advisory patch |