Information Disclosure

2022-09-1606:55:11

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

buildah

configureuidgid

information disclosure

container engine

unauthorized access

0.0005 Low

EPSS

Percentile

17.9%

JSON

github.com/containers/buildah is vulnerable to information disclosure. The vulnerability exists in configureUIDGID function in run_common.go due to improper handling of the supplementary groups in the Buildah container engine which allows an attacker to gain access to containers and perform unauthorized actions.

CPENameOperatorVersion
github.com/containers/buildaheqv1.27.0
buildaheq1.25.1-r1
buildaheq1.23.0-r0
buildaheq1.21.4-r0
buildaheq1.26.4-r0
buildaheq1.27.0-r1
buildaheq1.24.1-r0
buildaheq1.14.8-r0
buildaheq1.21.2-r0
buildaheq1.14.6-r0

Name	Operator	Version
github.com/containers/buildah	eq	v1.27.0
buildah	eq	1.25.1-r1
buildah	eq	1.23.0-r0
buildah	eq	1.21.4-r0
buildah	eq	1.26.4-r0
buildah	eq	1.27.0-r1
buildah	eq	1.24.1-r0
buildah	eq	1.14.8-r0
buildah	eq	1.21.2-r0
buildah	eq	1.14.6-r0