Skip to content
OpenAdvisories
Medium · 5.5 CVE-2021-3602 EUVD-2021-1446GHSA-7638-r9r3-rmjjGO-2022-0345

Buildah processes using chroot isolation may leak environment values to intermediate processes

Published Mar 3, 2022 · Updated Aug 3, 2024 · Assigned by redhat

Description

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).

Affected products

VendorProductAffectedFixed
— buildah Affects v1.21.2, v1.20.0, v1.19.8, v1.18.0, v1.17.1, v1.16.7, Fixed in v1.21.3, v1.19.9, v1.17.2, v1.16.8, v1.22.0 and above. —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 golang-github-containers-buildah 1.22.3+ds1-1 —
Debian 13 golang-github-containers-buildah 1.22.3+ds1-1 —
Debian 12 golang-github-containers-buildah 1.22.3+ds1-1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-github-containers-buildah No fix yet —
Ubuntu 25.10 golang-github-containers-buildah No fix yet —
Ubuntu 22.04 LTS golang-github-containers-buildah No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS golang-github-containers-buildah No fix yet —
Ubuntu Pro 24.04 LTS golang-github-containers-buildah No fix yet —
ReleasePackageFixed inAdvisory
RHEL 8 buildah +1 1.11.6-9.module+el8.5.0+12239+ec01067b RHSA-2021:4222, RHSA-2021:4221, RHSA-2021:4154
RHEL 8 cockpit-podman 11-1.module+el8.5.0+10223+f7559c42 RHSA-2021:4222, RHSA-2021:4221, RHSA-2021:4154
RHEL 8 conmon 2:2.0.15-1.module+el8.5.0+10223+f7559c42 RHSA-2021:4222, RHSA-2021:4221, RHSA-2021:4154
RHEL 8 container-selinux 2:2.130.0-1.module+el8.5.0+10223+f7559c42 RHSA-2021:4222, RHSA-2021:4221, RHSA-2021:4154
RHEL 8 containernetworking-plugins 0.8.3-4.module+el8.5.0+10223+f7559c42 RHSA-2021:4222, RHSA-2021:4221, RHSA-2021:4154
RHEL 8 crit +2 3.12-9.module+el8.5.0+10223+f7559c42 RHSA-2021:4222, RHSA-2021:4221, RHSA-2021:4154
RHEL 8 criu-libs +1 3.15-3.module+el8.5.0+12582+56d94c81 RHSA-2021:4154
RHEL 8 crun 0.18-2.module+el8.5.0+10306+3f72d66d RHSA-2021:4222, RHSA-2021:4154
RHEL 8 fuse-overlayfs 0.7.8-1.module+el8.5.0+10223+f7559c42 RHSA-2021:4222, RHSA-2021:4221, RHSA-2021:4154
RHEL 8 libslirp +1 4.3.1-1.module+el8.5.0+10306+3f72d66d RHSA-2021:4222, RHSA-2021:4154
RHEL 8 oci-seccomp-bpf-hook 1.2.0-3.module+el8.5.0+11073+ba5c6d09 RHSA-2021:4222, RHSA-2021:4154
RHEL 8 podman +3 1.6.4-26.module+el8.5.0+10223+f7559c42 RHSA-2021:4222, RHSA-2021:4221, RHSA-2021:4154
RHEL 8 podman-gvproxy 3.3.1-9.module+el8.5.0+12697+018f24d7 RHSA-2021:4154
RHEL 8 podman-plugins +1 3.0.1-6.module+el8.5.0+12609+beaa716d RHSA-2021:4222, RHSA-2021:4154
RHEL 8 python-podman +1 3.2.0-2.module+el8.5.0+12582+56d94c81 RHSA-2021:4154
RHEL 8 python-podman-api 1.2.0-0.2.gitd0a45fe.module+el8.5.0+10223+f7559c42 RHSA-2021:4221
RHEL 8 runc 1.0.0-66.rc10.module+el8.5.0+11041+627a5cdc RHSA-2021:4222, RHSA-2021:4221, RHSA-2021:4154
RHEL 8 skopeo +2 1:0.1.41-4.module+el8.5.0+10223+f7559c42 RHSA-2021:4222, RHSA-2021:4221, RHSA-2021:4154
RHEL 8 slirp4netns 0.4.2-3.git21fdece.module+el8.5.0+10223+f7559c42 RHSA-2021:4222, RHSA-2021:4221, RHSA-2021:4154
RHEL 8 toolbox 0.0.7-1.module+el8.5.0+10223+f7559c42 RHSA-2021:4222, RHSA-2021:4221, RHSA-2021:4154
RHEL 8 toolbox-tests 0.0.99-1.module+el8.5.0+10306+3f72d66d RHSA-2021:4222, RHSA-2021:4154
RHEL 8 udica 0.2.1-2.module+el8.5.0+10223+f7559c42 RHSA-2021:4222, RHSA-2021:4221, RHSA-2021:4154

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 buildah +1 1.19.9-1.module_el8.5.0+2614+87221ce8 ALSA-2021:4222
AlmaLinux 8 cockpit-podman 11-1.module_el8.5.0+108+00865455 ALSA-2021:4222, ALSA-2021:4221
AlmaLinux 8 conmon 2:2.0.15-1.module_el8.5.0+108+00865455 ALSA-2021:4222, ALSA-2021:4221
AlmaLinux 8 container-selinux 2:2.130.0-1.module_el8.5.0+108+00865455 ALSA-2021:4222, ALSA-2021:4221
AlmaLinux 8 containernetworking-plugins 0.8.3-4.module_el8.5.0+108+00865455 ALSA-2021:4222, ALSA-2021:4221
AlmaLinux 8 crit +2 3.12-9.module_el8.3.0+2044+12421f43 ALSA-2021:4222, ALSA-2021:4221, ALSA-2021:4154
AlmaLinux 8 criu-libs +1 3.15-3.module_el8.5.0+2613+1b78b731 ALSA-2021:4154
AlmaLinux 8 crun 0.18-2.module_el8.5.0+2614+87221ce8 ALSA-2021:4222
AlmaLinux 8 fuse-overlayfs 0.7.8-1.module_el8.5.0+108+00865455 ALSA-2021:4222, ALSA-2021:4221
AlmaLinux 8 libslirp +1 4.3.1-1.module_el8.5.0+2614+87221ce8 ALSA-2021:4222, ALSA-2021:4154
AlmaLinux 8 oci-seccomp-bpf-hook 1.2.0-3.module_el8.5.0+2614+87221ce8 ALSA-2021:4222, ALSA-2021:4154
AlmaLinux 8 python-podman-api 1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455 ALSA-2021:4221
AlmaLinux 8 runc 1.0.0-66.rc10.module_el8.5.0+108+00865455 ALSA-2021:4222, ALSA-2021:4221
AlmaLinux 8 skopeo +2 1:0.1.41-4.module_el8.5.0+108+00865455 ALSA-2021:4221
AlmaLinux 8 slirp4netns 0.4.2-3.git21fdece.module_el8.5.0+108+00865455 ALSA-2021:4222, ALSA-2021:4221, ALSA-2021:4154
AlmaLinux 8 toolbox 0.0.7-1.module_el8.5.0+108+00865455 ALSA-2021:4221, ALSA-2021:4154
AlmaLinux 8 toolbox-tests 0.0.99.3-0.4.module_el8.5.0+2613+1b78b731 ALSA-2021:4154
AlmaLinux 8 udica 0.2.1-2.module_el8.5.0+108+00865455 ALSA-2021:4222, ALSA-2021:4221

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 buildah 1.11.6-9.module+el8.5.0+708+6758137d RLSA-2021:4222, RLSA-2021:4221, RLSA-2021:4154
Rocky Linux 8 cockpit-podman 11-1.module+el8.4.0+559+c02fa3b2 RLSA-2021:4222, RLSA-2021:4221, RLSA-2021:4154
Rocky Linux 8 conmon 2:2.0.15-1.module+el8.4.0+559+c02fa3b2 RLSA-2021:4222, RLSA-2021:4221, RLSA-2021:4154
Rocky Linux 8 container-selinux 2:2.130.0-1.module+el8.4.0+559+c02fa3b2 RLSA-2021:4222, RLSA-2021:4221, RLSA-2021:4154
Rocky Linux 8 containernetworking-plugins 0.8.3-4.module+el8.4.0+559+c02fa3b2 RLSA-2021:4222, RLSA-2021:4221, RLSA-2021:4154
Rocky Linux 8 containers-common 2:1-2.module+el8.5.0+710+4c471e88 RLSA-2021:4154
Rocky Linux 8 criu 3.12-9.module+el8.4.0+557+48ba8b2f RLSA-2021:4222, RLSA-2021:4221, RLSA-2021:4154
Rocky Linux 8 crun 0.18-2.module+el8.4.0+556+40122d08 RLSA-2021:4222, RLSA-2021:4154
Rocky Linux 8 fuse-overlayfs 0.7.8-1.module+el8.4.0+559+c02fa3b2 RLSA-2021:4222, RLSA-2021:4221, RLSA-2021:4154
Rocky Linux 8 libslirp 4.3.1-1.module+el8.4.0+556+40122d08 RLSA-2021:4222, RLSA-2021:4154
Rocky Linux 8 oci-seccomp-bpf-hook 1.2.0-3.module+el8.5.0+709+440d5e7e RLSA-2021:4222, RLSA-2021:4154
Rocky Linux 8 podman 1.6.4-26.module+el8.4.0+559+c02fa3b2 RLSA-2021:4222, RLSA-2021:4221, RLSA-2021:4154
Rocky Linux 8 python-podman 3.2.0-2.module+el8.5.0+710+4c471e88 RLSA-2021:4154
Rocky Linux 8 python-podman-api 1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2 RLSA-2021:4221
Rocky Linux 8 runc 1.0.0-66.rc10.module+el8.5.0+708+6758137d RLSA-2021:4222, RLSA-2021:4221, RLSA-2021:4154
Rocky Linux 8 skopeo 1:0.1.41-4.module+el8.4.0+559+c02fa3b2 RLSA-2021:4222, RLSA-2021:4221, RLSA-2021:4154
Rocky Linux 8 slirp4netns 0.4.2-3.git21fdece.module+el8.4.0+536+994a2182 RLSA-2021:4222, RLSA-2021:4221, RLSA-2021:4154
Rocky Linux 8 toolbox 0.0.7-1.module+el8.4.0+559+c02fa3b2 RLSA-2021:4222, RLSA-2021:4221, RLSA-2021:4154
Rocky Linux 8 udica 0.2.1-2.module+el8.4.0+559+c02fa3b2 RLSA-2021:4222, RLSA-2021:4221, RLSA-2021:4154
ReleasePackageFixed inAdvisory
SLES 15 SP3 conmon 2.0.30-150300.8.3.1 SUSE-SU-2022:23018-1
SLES 15 SP3 libcontainers-common 20210626-150300.8.3.1 SUSE-SU-2022:23018-1
SLES 15 SP3 libseccomp 2.5.3-150300.10.5.1 SUSE-SU-2022:23018-1
SLES 15 SP3 podman 3.4.4-150300.9.3.2 SUSE-SU-2022:23018-1
SLES 15 SP2 libcontainers-common 20210626-150100.3.15.1 SUSE-SU-2022:3312-1
SLES 15 SP1 libcontainers-common 20210626-150100.3.15.1 SUSE-SU-2022:3312-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP2 libcontainers-common 20210626-150100.3.15.1 SUSE-SU-2022:3312-1
SLES for SAP 15 SP1 libcontainers-common 20210626-150100.3.15.1 SUSE-SU-2022:3312-1
SLE Micro 5.1 conmon 2.0.30-150300.8.3.1 SUSE-SU-2022:23018-1
SLE Micro 5.1 libcontainers-common 20210626-150300.8.3.1 SUSE-SU-2022:23018-1
SLE Micro 5.1 libseccomp 2.5.3-150300.10.5.1 SUSE-SU-2022:23018-1
SLE Micro 5.1 podman 3.4.4-150300.9.3.2 SUSE-SU-2022:23018-1
SLE HPC 15 SP2 libcontainers-common 20210626-150100.3.15.1 SUSE-SU-2022:3312-1
SLE HPC 15 SP1 libcontainers-common 20210626-150100.3.15.1 SUSE-SU-2022:3312-1
SUSE Manager Server 4.1 libcontainers-common 20210626-150100.3.15.1 SUSE-SU-2022:3312-1
SUSE Manager Retail Branch Server 4.1 libcontainers-common 20210626-150100.3.15.1 SUSE-SU-2022:3312-1
SUSE Manager Proxy 4.1 libcontainers-common 20210626-150100.3.15.1 SUSE-SU-2022:3312-1
SUSE Enterprise Storage 7 libcontainers-common 20210626-150100.3.15.1 SUSE-SU-2022:3312-1
SUSE Enterprise Storage 6 libcontainers-common 20210626-150100.3.15.1 SUSE-SU-2022:3312-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libcontainers-common 20210626-7.1 openSUSE-SU-2024:11757-1
openSUSE Leap 15.3 conmon 2.0.30-150300.8.3.1 openSUSE-SU-2022:23018-1
openSUSE Leap 15.3 libcontainers-common 20210626-150300.8.3.1 openSUSE-SU-2022:23018-1
openSUSE Leap 15.3 libseccomp 2.5.3-150300.10.5.1 openSUSE-SU-2022:23018-1
openSUSE Leap 15.3 podman 3.4.4-150300.9.3.2 openSUSE-SU-2022:23018-1
ReleasePackageFixed inAdvisory
Alpine v3.24 buildah 1.21.3-r0 —
Alpine v3.24 podman 3.2.3-r0 —
Alpine v3.23 buildah 1.21.3-r0 —
Alpine v3.23 podman 3.2.3-r0 —
Alpine v3.22 buildah 1.21.3-r0 —
Alpine v3.22 podman 3.2.3-r0 —
Alpine v3.21 buildah 1.21.3-r0 —
Alpine v3.21 podman 3.2.3-r0 —
Alpine v3.20 buildah 1.21.3-r0 —
Alpine v3.20 podman 3.2.3-r0 —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 buildah 1.21.3-r0 —
Alpine v3.19 podman 3.2.3-r0 —
Alpine v3.18 buildah 1.21.3-r0 —
Alpine v3.18 podman 3.2.3-r0 —
Alpine v3.17 buildah 1.21.3-r0 —
Alpine v3.17 podman 3.2.3-r0 —
Alpine v3.16 buildah 1.21.3-r0 —
Alpine v3.16 podman 3.2.3-r0 —
Alpine v3.15 buildah 1.21.3-r0 —
Alpine v3.15 podman 3.2.3-r0 —
Alpine v3.14 buildah 1.21.3-r0 —
Alpine v3.14 podman 3.2.3-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 buildah 1.41.4-2 —
Azure Linux 2 (CBL-Mariner) cri-o 1.21.7-2 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 buildah +1 1.11.6-9.0.1.module+el8.5.0+20355+d36cb39d ELSA-2021-4222, ELSA-2021-4221, ELSA-2021-4154
Oracle Linux 8 cockpit-podman 11-1.module+el8.5.0+20355+d36cb39d ELSA-2021-4222, ELSA-2021-4221, ELSA-2021-4154
Oracle Linux 8 conmon 2:2.0.15-1.module+el8.5.0+20355+d36cb39d ELSA-2021-4222, ELSA-2021-4221, ELSA-2021-4154
Oracle Linux 8 container-selinux 2:2.130.0-1.module+el8.5.0+20355+d36cb39d ELSA-2021-4222, ELSA-2021-4221, ELSA-2021-4154
Oracle Linux 8 containernetworking-plugins 0.8.3-4.0.1.module+el8.5.0+20355+d36cb39d ELSA-2021-4222, ELSA-2021-4221, ELSA-2021-4154
Oracle Linux 8 crit +2 3.12-9.module+el8.5.0+20355+d36cb39d ELSA-2021-4222, ELSA-2021-4221, ELSA-2021-4154
Oracle Linux 8 criu-libs +1 3.15-3.module+el8.5.0+20416+d687fed7 ELSA-2021-4154
Oracle Linux 8 crun 0.18-2.module+el8.5.0+20341+152f6d53 ELSA-2021-4222, ELSA-2021-4154
Oracle Linux 8 fuse-overlayfs 0.7.8-1.module+el8.5.0+20355+d36cb39d ELSA-2021-4222, ELSA-2021-4221, ELSA-2021-4154
Oracle Linux 8 libslirp +1 4.3.1-1.module+el8.5.0+20341+152f6d53 ELSA-2021-4222, ELSA-2021-4154
Oracle Linux 8 oci-seccomp-bpf-hook 1.2.0-3.module+el8.5.0+20341+152f6d53 ELSA-2021-4222, ELSA-2021-4154
Oracle Linux 8 podman +3 1.6.4-26.0.1.module+el8.5.0+20355+d36cb39d ELSA-2021-4222, ELSA-2021-4221, ELSA-2021-4154
Oracle Linux 8 podman-gvproxy 3.3.1-9.0.1.module+el8.5.0+20416+d687fed7 ELSA-2021-4154
Oracle Linux 8 podman-plugins +1 3.0.1-6.0.1.module+el8.5.0+20408+23b8328e ELSA-2021-4222, ELSA-2021-4154
Oracle Linux 8 python-podman-api 1.2.0-0.2.gitd0a45fe.module+el8.5.0+20355+d36cb39d ELSA-2021-4221
Oracle Linux 8 python3-podman 3.2.0-2.module+el8.5.0+20416+d687fed7 ELSA-2021-4154
Oracle Linux 8 runc 1.0.0-66.rc10.module+el8.5.0+20355+d36cb39d ELSA-2021-4222, ELSA-2021-4221, ELSA-2021-4154
Oracle Linux 8 skopeo +2 1:0.1.41-4.0.1.module+el8.5.0+20355+d36cb39d ELSA-2021-4222, ELSA-2021-4221, ELSA-2021-4154
Oracle Linux 8 slirp4netns 0.4.2-3.git21fdece.module+el8.5.0+20355+d36cb39d ELSA-2021-4222, ELSA-2021-4221, ELSA-2021-4154
Oracle Linux 8 udica 0.2.1-2.module+el8.5.0+20355+d36cb39d ELSA-2021-4222, ELSA-2021-4221, ELSA-2021-4154

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/containers/buildah < 1.16.8 1.16.8 GHSA-7638-r9r3-rmjj
Go github.com/containers/buildah >= 1.17.0, < 1.17.2 1.17.2 GHSA-7638-r9r3-rmjj
Go github.com/containers/buildah >= 1.18.0, < 1.19.9 1.19.9 GHSA-7638-r9r3-rmjj
Go github.com/containers/buildah >= 1.20.0, < 1.21.3 1.21.3 GHSA-7638-r9r3-rmjj
Go github.com/containers/buildah < 1.22.0 1.22.0 GO-2022-0345

Advisories 17

References