CVE-2021-3602
published 2022-03-03CVE-2021-3602: An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile…
PriorityP425medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.33%
24.5th percentile
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| buildah_project | buildah | < 1.16.8 | 1.16.8 |
| buildah_project | buildah | — | — |
| buildah_project | buildah | >= 1.17.0 < 1.17.2 | 1.17.2 |
| buildah_project | buildah | >= 1.19.0 < 1.19.9 | 1.19.9 |
| buildah_project | buildah | >= 1.21.0 < 1.21.3 | 1.21.3 |
| debian | golang-github-containers-buildah | < golang-github-containers-buildah 1.22.3+ds1-1 (bookworm) | golang-github-containers-buildah 1.22.3+ds1-1 (bookworm) |
| github.com | containers_buildah | >= 0 < 1.16.8 | 1.16.8 |
| github.com | containers_buildah | >= 0 < 1.22.0 | 1.22.0 |
| github.com | containers_buildah | >= 1.17.0 < 1.17.2 | 1.17.2 |
| github.com | containers_buildah | >= 1.18.0 < 1.19.9 | 1.19.9 |
| github.com | containers_buildah | >= 1.20.0 < 1.21.3 | 1.21.3 |
| msrc | cbl2_cri-o_1.21.7-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_cri-o_1.21.7-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_for_ibm_z_systems | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:P/I:N/A:N
ghsa5.5MEDIUM
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Environment variable leakage in github.com/containers/buildah
osv·2022-07-15
CVE-2021-3602 Environment variable leakage in github.com/containers/buildah
Environment variable leakage in github.com/containers/buildah
The RunUsingChroot function unintentionally propagates environment variables from the current process to the child process.
OSV
CVE-2021-3602: An information disclosure flaw was found in Buildah, when building containers using chroot isolation
osv·2022-03-03·CVSS 5.5
CVE-2021-3602 [MEDIUM] CVE-2021-3602: An information disclosure flaw was found in Buildah, when building containers using chroot isolation
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
OSV
Buildah processes using chroot isolation may leak environment values to intermediate processes
osv·2021-07-19·CVSS 5.5
CVE-2021-3602 [MEDIUM] Buildah processes using chroot isolation may leak environment values to intermediate processes
Buildah processes using chroot isolation may leak environment values to intermediate processes
### Impact
When running processes using "chroot" isolation, the process being run can examine the environment variables of its immediate parent and grandparent processes (CVE-2021-3602). This isolation type is often used when running `buildah` in unprivileged containers, and it is often used to do so in CI/CD environments. If sensitive information is exposed to the original `buildah` process through its environment, that information will unintentionally be shared with child processes which it starts as part of handling RUN instructions or during `buildah run`. The commands that `buildah` is instructed to run can read that information if they choose to.
### Patches
Users should upgrade packages,
GHSA
Buildah processes using chroot isolation may leak environment values to intermediate processes
ghsa·2021-07-19·CVSS 5.5
CVE-2021-3602 [MEDIUM] CWE-200 Buildah processes using chroot isolation may leak environment values to intermediate processes
Buildah processes using chroot isolation may leak environment values to intermediate processes
### Impact
When running processes using "chroot" isolation, the process being run can examine the environment variables of its immediate parent and grandparent processes (CVE-2021-3602). This isolation type is often used when running `buildah` in unprivileged containers, and it is often used to do so in CI/CD environments. If sensitive information is exposed to the original `buildah` process through its environment, that information will unintentionally be shared with child processes which it starts as part of handling RUN instructions or during `buildah run`. The commands that `buildah` is instructed to run can read that information if they choose to.
### Patches
Users should upgrade packages,
Microsoft
An information disclosure flaw was found in Buildah when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variabl
vendor_msrc·2022-03-08·CVSS 5.5
CVE-2021-3602 [MEDIUM] CWE-212 An information disclosure flaw was found in Buildah when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variabl
An information disclosure flaw was found in Buildah when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source li
Red Hat
buildah: Host environment variables leaked in build container when using chroot isolation
vendor_redhat·2021-07-15·CVSS 5.5
CVE-2021-3602 [MEDIUM] CWE-200 buildah: Host environment variables leaked in build container when using chroot isolation
buildah: Host environment variables leaked in build container when using chroot isolation
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. W
Debian
CVE-2021-3602: golang-github-containers-buildah - An information disclosure flaw was found in Buildah, when building containers us...
vendor_debian·2021·CVSS 5.5
CVE-2021-3602 [MEDIUM] CVE-2021-3602: golang-github-containers-buildah - An information disclosure flaw was found in Buildah, when building containers us...
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
Scope: local
bookworm: resolved (fixed in 1.22.3+ds1-1)
bullseye: open
forky: resolved (fixed in 1.22.3+ds1-1)
sid: resolved (fixed in 1.22.3+ds1-1)
trixie: resolved (fixed in 1.22.3+ds1-1)
No detection rules found.
No public exploits indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1969264https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjjhttps://ubuntu.com/security/CVE-2021-3602https://bugzilla.redhat.com/show_bug.cgi?id=1969264https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjjhttps://ubuntu.com/security/CVE-2021-3602
2022-03-03
Published