CVE-2020-10696 — Path Traversal in Containers Buildah

CWE-22 — Path Traversal15 documents7 sources
Severity
8.8HIGHNVD
EPSS
0.3%
top 46.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Github.com Containers BuildahBuildah Project BuildahRED HAT Buildah+2 more
Timeline
PublishedMar 31
Latest updateAug 21

Description

A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5red_hat/buildahFixed in buildah-1.14.5

Also affects: Openshift Container Platform 3.11, Enterprise Linux 7.0, 8.0

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

5
OSV
Path Traversal in Buildah in github.com/containers/buildah↗2024-08-21
▶
GHSA
Path Traversal in Buildah↗2021-05-18
▶
OSV
Path Traversal in Buildah↗2021-05-18
▶
CVEList
CVE-2020-10696: A path traversal flaw was found in Buildah in versions before 1↗2020-03-31
▶
OSV
CVE-2020-10696: A path traversal flaw was found in Buildah in versions before 1↗2020-03-31
▶

📋Vendor Advisories

2
Red Hat
buildah: Crafted input tar file may lead to local file overwrite during image build process↗2020-03-26
▶
Debian
CVE-2020-10696: golang-github-containers-buildah - A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw ...↗2020
▶

💬Community

7
Bugzilla
CVE-2020-10696 buildah: Crafted input tar file may lead to local file overwrite during image build process [fedora-31]↗2020-03-26
▶
Bugzilla
CVE-2020-10696 buildah: Crafted input tar file may lead to local file overwrite during image build process [fedora-30]↗2020-03-26
▶
Bugzilla
CVE-2020-10696 podman: buildah: Crafted input tar file may lead to local file overwrite during image build process [fedora-31]↗2020-03-26
▶
Bugzilla
CVE-2020-10696 buildah: Crafted input tar file may lead to local file overwrite during image build process [openstack-rdo]↗2020-03-26
▶
Bugzilla
CVE-2020-10696 buildah: Crafted input tar file may lead to local file overwrite during image build process↗2020-03-26
▶
CVE-2020-10696 — Path Traversal in Containers Buildah | cvebase