Information Exposure Affecting github.com/containers/buildah/chroot package, versions >=1.20.0 <1.21.1 >=1.18.0 <1.19.9 >=1.17.0 <1.17.2 <1.16.8
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
20 Jul 2021
19 Jul 2021
How to fix?
github.com/containers/buildah/chroot to version 1.21.1, 1.19.9, 1.17.2, 1.16.8 or higher.
github.com/containers/buildah/chroot is an a tool that facilitates building OCI images.
Affected versions of this package are vulnerable to Information Exposure. When running processes using
chroot isolation, the process being run can examine the environment variables of its immediate parent and grandparent processes.
This isolation type is often used when running
buildah in unprivileged containers, and it is often used to do so in CI/CD environments. If sensitive information is exposed to the original
buildah process through its environment, that information will unintentionally be shared with child processes which it starts as part of handling
RUN instructions or during
buildah run. The commands that
buildah is instructed to run can read that information.