PatchTheCVEbuildah vulnerabilities and fixes
Recent CVEs affecting buildah, with upgrade or downgrade steps. 6 tracked.
buildah has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2024-10-09. Highest priority: CVE-2020-10696 (score 62/100).
- CVE-2024-9675 HIGH 7.8 MITIGATE DOWNGRADE A vulnerability was found in Buildah
- CVE-2022-2990 HIGH 7.1 UPGRADE DOWNGRADE An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive
- CVE-2022-27651 MEDIUM 6.8 UPGRADE MITIGATE A flaw was found in buildah where containers were incorrectly started with non-empty default permissions
- CVE-2021-3602 MEDIUM 5.5 UPGRADE MITIGATE An information disclosure flaw was found in Buildah, when building containers using chroot isolation
- CVE-2020-10696 HIGH 8.8 UPGRADE DOWNGRADE A path traversal flaw was found in Buildah in versions before 1.14.5
- CVE-2019-10214 MEDIUM 5.9 MITIGATE MITIGATE The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Lin
FAQ
How do I fix buildah vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is buildah being exploited right now?
None of the tracked buildah CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which buildah CVE should I patch first?
CVE-2020-10696 currently ranks highest (62/100): A path traversal flaw was found in Buildah in versions before 1.14.5.