Information Exposure Affecting github.com/containers/buildah/chroot Open this link in a new tab package, versions >=1.20.0 <1.21.1 >=1.18.0 <1.19.9 >=1.17.0 <1.17.2 <1.16.8


0.0
low
  • Attack Complexity

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-GOLANG-GITHUBCOMCONTAINERSBUILDAHCHROOT-1320081

  • published

    20 Jul 2021

  • disclosed

    19 Jul 2021

  • credit

    Blake Burkhart

How to fix?

Upgrade github.com/containers/buildah/chroot to version 1.21.1, 1.19.9, 1.17.2, 1.16.8 or higher.

Overview

github.com/containers/buildah/chroot is an a tool that facilitates building OCI images.

Affected versions of this package are vulnerable to Information Exposure. When running processes using chroot isolation, the process being run can examine the environment variables of its immediate parent and grandparent processes. This isolation type is often used when running buildah in unprivileged containers, and it is often used to do so in CI/CD environments. If sensitive information is exposed to the original buildah process through its environment, that information will unintentionally be shared with child processes which it starts as part of handling RUN instructions or during buildah run. The commands that buildah is instructed to run can read that information.

References