Information disclosure in Buildah_project Buildah
CVE-2021-3602
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent process…
Vulnerability class: Information Disclosure
EPSS: 0.003 (23.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Buildah_project Buildah
- Redhat Enterprise_linux — versions 8.0
- Redhat Enterprise_linux_for_ibm_z_systems — versions 8.0
- Redhat Enterprise_linux_for_power_little_endian — versions 8.0
- N/a Buildah — versions Affects v1.21.2, v1.20.0, v1.19.8, v1.18.0, v1.17.1, v1.16.7, Fixed in v1.21.3, v1.19.9, v1.17.2, v1.16.8, v1.22.0 and above.
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (Patch, Third Party Advisory, x_refsource_MISC, Issue Tracking)
- secalert@redhat.com (Patch, Third Party Advisory, x_refsource_MISC)
- secalert@redhat.com (Third Party Advisory, x_refsource_MISC)
- secalert@redhat.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-3602?
- CVE-2021-3602 is a medium-severity vulnerability in Buildah_project Buildah, classified under Information Disclosure. CVSS score: 5.5/10. Published 2022-03-03.
- How severe is CVE-2021-3602?
- Medium severity. CVSS v3 base score is 5.5 out of 10.
- Is CVE-2021-3602 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.