CVE-2021-3602

Katalog CVE

CVSS 5.5 · Medium EPSS 0,33%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada buildah project buildah, redhat enterprise linux +2 lainnya. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).

Rincian

Terbit di NVD

3 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 23,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1969264 issue tracking · patch · advisory pihak ketiga
• https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0 patch · advisory pihak ketiga
• https://ubuntu.com/security/CVE-2021-3602 patch · advisory pihak ketiga
• https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjj advisory pihak ketiga