VDB
Sign up
MEDIUM4.4

GHSA-586p-749j-fhwp

Buildah allows arbitrary directory mount

Quick fix

GHSA-586p-749j-fhwp — github.com/containers/buildah: upgrade to the fixed version with the command below.

go get github.com/containers/buildah@v1.38.0

Details

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/containers/buildah
Introduced in: 0Fixed in: 1.38.0
Fixgo get github.com/containers/buildah@v1.38.0

References