Database/Container, Kubernetes & orchestration

Buildah: Symlink following when reading .containerignore/.dockerignore discloses host files

CVE-2022-4122Container, Kubernetes & orchestrationcurated

Impact

Symlink following when reading .containerignore/.dockerignore discloses host files

Who can reach it

Malicious build context

What to do

Upgrade Buildah on build hosts

References

https://nvd.nist.gov/vuln/detail/CVE-2022-4122

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.