Vulnerability GHSA-49p4-px3h-rq49

Medium Risk

4 months ago

Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

v1.38.1 - v1.43.1

Summary

Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

Details

Impact

When processing a build contexts or add/copy instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build.

Patches

Fixed in Buildah 1.44 and 1.43.2.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Unknown

3 months ago

Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah

v1.38.1 - v1.46.0 GO-2026-5116

Unknown

1 year ago

Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah

v0.16.0 - v1.33.11 and v1.35.0 - v1.35.4 and v1.37.0 - v1.37.5 and v1.38.0 GO-2025-3414

High Risk

1 year ago

Buildah allows build breakout using malicious Containerfiles and concurrent builds

v0.16.0 - v1.33.11 and v1.35.0 - v1.35.4 and v1.37.0 - v1.37.5 and v1.38.0 GHSA-5vpc-35f4-r8w6

Unknown

2 years ago

Buildah allows arbitrary directory mount in github.com/containers/buildah

v0.16.0 - v1.37.0 GO-2024-3186

Unknown

2 years ago

Improper Input Validation in Buildah and Podman in github.com/containers/buildah

v0.16.0 - v1.37.3 GO-2024-3169

View all vulnerabilities for these packages

Impacted packages

github.com/containers/buildah

Timeline

Published

4 months ago

Fixed (v1.43.2)

5 months ago

Last Modified

3 months ago