Bug 1969264 (CVE-2021-3602)
| Summary: | CVE-2021-3602 buildah: Host environment variables leaked in build container when using chroot isolation | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sam Fowler <sfowler> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | acui, adam.kaplan, amurdaca, aos-bugs, bbaude, bburky, bdettelb, bmontgom, container-sig, debarshir, dwalsh, eparis, jburrell, jligon, jnovy, jokerman, lsm5, mheon, nalin, nstielau, patrick, pehunt, pthomas, rh.container.bot, rphillips, santiago, security-response-team, sfowler, sponnaga, tomckay, tsweeney, umohnani |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | buildah 1.21.3, buildah 1.19.9, buildah 1.17.2, buildah 1.16.8 | Doc Type: | If docs needed, set a value |
| Doc Text: |
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-10-28 02:59:42 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1972049, 1977937, 1977938, 1977939, 1977940, 1977941, 1977942, 1977943, 1977944, 1982880, 1982881 | ||
| Bug Blocks: | 1968682 | ||