CVE-2022-27651

Name
CVE-2022-27651
Description
A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/containers/buildah/commit/e7e55c988c05dd74005184ceb64f097a0cfe645b
MISC https://bugzilla.redhat.com/show_bug.cgi?id=2066840
MISC https://github.com/containers/buildah/security/advisories/GHSA-c3g4-w6cv-6v7h
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2VWH6X6HOFPO6HTESF42HIJZEPXSWVIO/
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NETC7I6RTMMBRJJQVJOJUPDK4W4PQSJ/
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25YI27MENCEPZTTGRVU6BQD5V53FNI52/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VWH6X6HOFPO6HTESF42HIJZEPXSWVIO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7NETC7I6RTMMBRJJQVJOJUPDK4W4PQSJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25YI27MENCEPZTTGRVU6BQD5V53FNI52/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:buildah_project:buildah:*:*:*:*:*:*:*:* buildah >= None < 1.25.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
buildah edge-community 1.21.3-r0 Michał Polański <michal@polanski.me> possibly vulnerable
buildah edge-community 1.19.4-r0 None possibly vulnerable
buildah edge-community 1.14.4-r0 None possibly vulnerable
buildah 3.22-community 1.21.3-r0 None possibly vulnerable
buildah 3.22-community 1.19.4-r0 None possibly vulnerable
buildah 3.22-community 1.14.4-r0 None possibly vulnerable