GHSA-4crw-w8pw-2hmf

ghsaUSosv

Buildah (as part of Podman) vulnerable to Link Following

view advisory published 2022-12-08Licence: CC-BY-4.0

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-4122US	medium5.3	0.86% (58th)	—	2022-12-08
A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure.

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=2144983WEB
https://github.com/containers/podman/commit/c8eeab21cf0a4f670be0cd399dd06fd5d4e06dfeWEB
https://github.com/containers/podman/pull/16315WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-4122ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan