SUSE update for buildah



Published: 2022-08-06
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2022-27651
CWE-ID CWE-276
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
SUSE Linux Enterprise Module for Containers
Operating systems & Components / Operating system

SUSE Manager Retail Branch Server
Operating systems & Components / Operating system

SUSE Manager Server
Operating systems & Components / Operating system

SUSE Manager Proxy
Operating systems & Components / Operating system

SUSE Linux Enterprise Server
Operating systems & Components / Operating system

openSUSE Leap
Operating systems & Components / Operating system

SUSE Linux Enterprise Server for SAP Applications
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing
Operating systems & Components / Operating system

buildah
Operating systems & Components / Operating system package or component

Vendor SuSE

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Incorrect default permissions

EUVDB-ID: #VU61797

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27651

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A remote attacker can view contents of files and directories or modify them.

Mitigation

Update the affected package buildah to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Containers: 15-SP4

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

buildah: before 1.25.1-150400.3.3.28


CPE2.3 External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222680-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###