- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 9 · 4 high, 2 medium
- Registry
- pkg.go.dev
Advisories 9
- CVE-2026-44517Medium 6.3
Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive
Affected: from 1.38.1; from 1.38.1, fixed in 1.43.2.
- CVE-2024-11218High 8.6
Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile
Affected: from 1.38.0, fixed in 1.38.1; from 1.37.0, fixed in 1.37.6; from 1.35.0, fixed in 1.35.5; fixed in 1.33.12; fixed in 1.33.12; from 1.35.0, fixed in 1.35.5; from 1.37.0, fixed in 1.37.6; from 1.38.0, fixed in 1.38.1.
- CVE-2024-9675High 7.8
Buildah: buildah allows arbitrary directory mount
Affected: fixed in 1.38.0; fixed in 1.37.1.
- CVE-2024-9407Medium 4.7
Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction
Affected: fixed in 1.37.4.
- CVE-2024-1753High 8.6
Buildah: buildah: container escape via improper bind mount validation
Affected: from 1.35.0, fixed in 1.35.1; from 1.34.0, fixed in 1.34.3; from 1.33.0, fixed in 1.33.7; from 1.25.0, fixed in 1.27.4; from 1.24.0, fixed in 1.24.7; from 1.28.0, fixed in 1.29.3; from 1.30.0, fixed in 1.31.5; from 1.32.0, fixed in 1.32.3; fixed in 1.35.1.
- CVE-2022-2990Unrated
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or…
Affected: fixed in 1.27.1.
- CVE-2022-27651Unrated
A flaw was found in buildah where containers were incorrectly started with non-empty default permissions.
Affected: fixed in 1.25.0.
- CVE-2021-3602Unrated
An information disclosure flaw was found in Buildah, when building containers using chroot isolation.
Affected: fixed in 1.22.0; fixed in 1.16.8; from 1.17.0, fixed in 1.17.2; from 1.18.0, fixed in 1.19.9; from 1.20.0, fixed in 1.21.3.
- CVE-2020-10696High 8.8
A path traversal flaw was found in Buildah in versions before 1.14.5.
Affected: fixed in 1.14.4.