CVE-2022-4122

CWE-598 documents6 sources
Severity
5.3MEDIUM
EPSS
0.2%
top 60.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Containers/podman/v4Fedoraproject FedoraPodman Project Podman
Timeline
PublishedDec 8
Latest updateAug 21

Description

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5podmanPodman 4.3.0

Also affects: Fedora 35, 36, 37

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
OSV
Buildah (as part of Podman) vulnerable to Link Following in github.com/containers/podman↗2024-08-21
▶
GHSA
Buildah (as part of Podman) vulnerable to Link Following↗2022-12-08
▶
OSV
CVE-2022-4122: A vulnerability was found in buildah↗2022-12-08
▶
CVEList
CVE-2022-4122: A vulnerability was found in buildah↗2022-12-08
▶
OSV
Buildah (as part of Podman) vulnerable to Link Following↗2022-12-08
▶

📋Vendor Advisories

2
Red Hat
podman: Symlink error leads to information disclosure↗2022-11-22
▶
Debian
CVE-2022-4122: golang-github-containers-buildah - A vulnerability was found in buildah. Incorrect following of symlinks while read...↗2022
▶
CVE-2022-4122 (MEDIUM CVSS 5.3) | A vulnerability was found in builda | cvebase.io