PkgSeer

Vulnerability GHSA-586p-749j-fhwp

Medium Risk

2 years ago

Buildah allows arbitrary directory mount

v0.16.0 - v1.37.8

Summary

Buildah allows arbitrary directory mount

Details

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah

v1.38.1 - v1.46.0 GO-2026-5116

Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

v1.38.1 - v1.43.1 GHSA-49p4-px3h-rq49

Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah

v0.16.0 - v1.33.11 and v1.35.0 - v1.35.4 and v1.37.0 - v1.37.5 and v1.38.0 GO-2025-3414

Buildah allows build breakout using malicious Containerfiles and concurrent builds

v0.16.0 - v1.33.11 and v1.35.0 - v1.35.4 and v1.37.0 - v1.37.5 and v1.38.0 GHSA-5vpc-35f4-r8w6

Buildah allows arbitrary directory mount in github.com/containers/buildah

v0.16.0 - v1.37.0 GO-2024-3186

View all vulnerabilities for these packages

Impacted packages

github.com/containers/buildah

Timeline

Published

2 years ago

Fixed (v1.38.0)

1 year ago

Last Modified

9 hours ago