Buildah 信息泄露漏洞

漏洞信息详情

Buildah是一款支持构建OCI容器映像的工具。

Buildah存在安全漏洞，该漏洞源于在容器构建中运行的进程(例如Dockerfile RUN命令)可以访问父进程和祖父进程的环境变量。当在CI CD环境中的容器中运行时，环境变量可能包括与容器共享的敏感信息，以便仅由build本身使用(例如容器注册表凭证)。

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://access.redhat.com

来源:vigilance.fr

链接:https://vigilance.fr/vulnerability/podman-information-disclosure-via-Host-Environment-Variables-35980

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.3794

来源:www.cybersecurity-help.cz

链接:https://www.cybersecurity-help.cz/vdb/SB2021071902

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/164893/Red-Hat-Security-Advisory-2021-4222-02.html

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.3721

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.3795

来源:www.cybersecurity-help.cz

链接:https://www.cybersecurity-help.cz/vdb/SB2021072007

来源:access.redhat.com

链接:https://access.redhat.com/security/cve/cve-2021-3602

暂无