CVE-2021-3602 — Sensitive Information Exposure

Vendor	Product	Version range	Fixed in
buildah_project	buildah	< 1.16.8	1.16.8
buildah_project	buildah	—	—
buildah_project	buildah	>= 1.17.0 < 1.17.2	1.17.2
buildah_project	buildah	>= 1.19.0 < 1.19.9	1.19.9
buildah_project	buildah	>= 1.21.0 < 1.21.3	1.21.3
debian	golang-github-containers-buildah	< golang-github-containers-buildah 1.22.3+ds1-1 (bookworm)	golang-github-containers-buildah 1.22.3+ds1-1 (bookworm)
github.com	containers_buildah	>= 0 < 1.16.8	1.16.8
github.com	containers_buildah	>= 0 < 1.22.0	1.22.0
github.com	containers_buildah	>= 1.17.0 < 1.17.2	1.17.2
github.com	containers_buildah	>= 1.18.0 < 1.19.9	1.19.9
github.com	containers_buildah	>= 1.20.0 < 1.21.3	1.21.3
msrc	cbl2_cri-o_1.21.7-2_on_cbl_mariner_2.0	—	—
msrc	cbl2_cri-o_1.21.7-3_on_cbl_mariner_2.0	—	—
msrc	cbl_mariner_2.0_arm	—	—
msrc	cbl_mariner_2.0_x64	—	—
redhat	enterprise_linux	—	—
redhat	enterprise_linux_for_ibm_z_systems	—	—
redhat	enterprise_linux_for_power_little_endian	—	—

OSV

Environment variable leakage in github.com/containers/buildah

osv·2022-07-15

CVE-2021-3602 Environment variable leakage in github.com/containers/buildah Environment variable leakage in github.com/containers/buildah The RunUsingChroot function unintentionally propagates environment variables from the current process to the child process.

OSV

CVE-2021-3602: An information disclosure flaw was found in Buildah, when building containers using chroot isolation

osv·2022-03-03·CVSS 5.5

CVE-2021-3602 [MEDIUM] CVE-2021-3602: An information disclosure flaw was found in Buildah, when building containers using chroot isolation An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).

OSV

Buildah processes using chroot isolation may leak environment values to intermediate processes

osv·2021-07-19·CVSS 5.5

CVE-2021-3602 [MEDIUM] Buildah processes using chroot isolation may leak environment values to intermediate processes Buildah processes using chroot isolation may leak environment values to intermediate processes ### Impact When running processes using "chroot" isolation, the process being run can examine the environment variables of its immediate parent and grandparent processes (CVE-2021-3602). This isolation type is often used when running `buildah` in unprivileged containers, and it is often used to do so in CI/CD environments. If sensitive information is exposed to the original `buildah` process through its environment, that information will unintentionally be shared with child processes which it starts as part of handling RUN instructions or during `buildah run`. The commands that `buildah` is instructed to run can read that information if they choose to. ### Patches Users should upgrade packages,

GHSA

Buildah processes using chroot isolation may leak environment values to intermediate processes

ghsa·2021-07-19·CVSS 5.5

CVE-2021-3602 [MEDIUM] CWE-200 Buildah processes using chroot isolation may leak environment values to intermediate processes Buildah processes using chroot isolation may leak environment values to intermediate processes ### Impact When running processes using "chroot" isolation, the process being run can examine the environment variables of its immediate parent and grandparent processes (CVE-2021-3602). This isolation type is often used when running `buildah` in unprivileged containers, and it is often used to do so in CI/CD environments. If sensitive information is exposed to the original `buildah` process through its environment, that information will unintentionally be shared with child processes which it starts as part of handling RUN instructions or during `buildah run`. The commands that `buildah` is instructed to run can read that information if they choose to. ### Patches Users should upgrade packages,

Microsoft

An information disclosure flaw was found in Buildah when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variabl

vendor_msrc·2022-03-08·CVSS 5.5

CVE-2021-3602 [MEDIUM] CWE-212 An information disclosure flaw was found in Buildah when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variabl An information disclosure flaw was found in Buildah when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials). FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source li

Red Hat

buildah: Host environment variables leaked in build container when using chroot isolation

vendor_redhat·2021-07-15·CVSS 5.5

CVE-2021-3602 [MEDIUM] CWE-200 buildah: Host environment variables leaked in build container when using chroot isolation buildah: Host environment variables leaked in build container when using chroot isolation An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials). An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. W

Debian

CVE-2021-3602: golang-github-containers-buildah - An information disclosure flaw was found in Buildah, when building containers us...

vendor_debian·2021·CVSS 5.5

CVE-2021-3602 [MEDIUM] CVE-2021-3602: golang-github-containers-buildah - An information disclosure flaw was found in Buildah, when building containers us... An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials). Scope: local bookworm: resolved (fixed in 1.22.3+ds1-1) bullseye: open forky: resolved (fixed in 1.22.3+ds1-1) sid: resolved (fixed in 1.22.3+ds1-1) trixie: resolved (fixed in 1.22.3+ds1-1)

CVE-2021-3602: An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile…

Affected

CVSS provenance