Homepage

Information Exposure The advisory has been revoked - it doesn't affect any version of package podman-plugins  (opens in a new tab)

Threat Intelligence

EPSS
0.33% (25th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-PODMANPLUGINS-10382050
  • published18 Jun 2025
  • disclosed15 Jul 2021
Report a new vulnerability Found a mistake?

Introduced: 15 Jul 2021

CVE-2021-3602  (opens in a new tab)
CWE-200  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream podman-plugins package and not the podman-plugins package as distributed by RHEL.

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).