GHSA-rprg-4v7q-87v7

Buildah (as part of Podman) vulnerable to Path Traversal

Source: GitHub Advisory Database (reviewed) Low CVE-2022-4123

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/containers/podman/v4	>= 4.1.0-rc1, <= 4.4.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-4123 advisory
https://github.com/containers/podman/issues/13293 web
https://github.com/containers/podman/pull/13531 web
https://github.com/containers/podman/commit/7934b77dd5372c22063686a218b8b48c2fcaca8c web
https://bugzilla.redhat.com/show_bug.cgi?id=2144989 web
https://github.com/containers/podman package
https://pkg.go.dev/vuln/GO-2022-1159 web