Information Exposure Affecting github.com/containers/buildah/chroot package, versions >=1.20.0 <1.21.1 >=1.18.0 <1.19.9 >=1.17.0 <1.17.2 <1.16.8
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMCONTAINERSBUILDAHCHROOT-1320081
- published 20 Jul 2021
- disclosed 19 Jul 2021
- credit Blake Burkhart
Introduced: 19 Jul 2021
CVE-2021-3602 Open this link in a new tabHow to fix?
Upgrade github.com/containers/buildah/chroot to version 1.21.1, 1.19.9, 1.17.2, 1.16.8 or higher.
Overview
github.com/containers/buildah/chroot is an a tool that facilitates building OCI images.
Affected versions of this package are vulnerable to Information Exposure. When running processes using chroot isolation, the process being run can examine the environment variables of its immediate parent and grandparent processes.
This isolation type is often used when running buildah in unprivileged containers, and it is often used to do so in CI/CD environments. If sensitive information is exposed to the original buildah process through its environment, that information will unintentionally be shared with child processes which it starts as part of handling RUN instructions or during buildah run. The commands that buildah is instructed to run can read that information.