Path traversal in buildah - CVE-2020-10696

Vulnerability identifier: #VU26643

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-10696

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can trick a victim to build a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.

buildah
Red Hat OpenShift Container Platform
podman (Red Hat package)
buildah (Red Hat package)
buildah (Alpine package)
buildah
libgpg-error0-32bit
libgpg-error0-32bit-debuginfo
libgpg-error-debugsource
libgpg-error-devel-32bit-debuginfo
libgpg-error-devel-32bit
libgpg-error-devel-debuginfo
libgpg-error-devel
libgpg-error0-debuginfo
libgpg-error0
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
SUSE Linux Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Containers
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap

Install update from vendor's website.

buildah - update to 1.14.4
podman (Red Hat package) - addressed in versions 1.0.2-4.dev.git96ccc2e.rhaos4.1.el8, 1.4.2-6.rhaos4.2.el8, 1.6.4-10.rhaos4.3.el8, 1.6.4-18.el7_8
buildah (Red Hat package) - update to 1.11.6-11.el7_8
buildah (Alpine package) - update to 1.15.0-r0
buildah - addressed in versions 1.25.1-150100.3.13.12, 1.27.1-150300.8.11.1, 1.27.1-150400.3.8.1, 1.28.2-150300.8.14.1, 1.28.2-150400.3.11.1
libgpg-error0-32bit - update to 1.42-150300.9.3.1
libgpg-error0-32bit-debuginfo - update to 1.42-150300.9.3.1
libgpg-error-debugsource - update to 1.42-150300.9.3.1
libgpg-error-devel-32bit-debuginfo - update to 1.42-150300.9.3.1
libgpg-error-devel-32bit - update to 1.42-150300.9.3.1
libgpg-error-devel-debuginfo - update to 1.42-150300.9.3.1
libgpg-error-devel - update to 1.42-150300.9.3.1
libgpg-error0-debuginfo - update to 1.42-150300.9.3.1
libgpg-error0 - update to 1.42-150300.9.3.1
Red Hat OpenShift Container Platform - addressed in versions 4.1.41, 4.2.28

• https://access.redhat.com/security/cve/cve-2020-10696
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10696
• https://github.com/containers/buildah/pull/2245

• Path traversal in Container Projects Buildah
• Red Hat Enterprise Linux 8 update for the container-tools:1.0 module
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Red Hat Enterprise Linux 8 update for the container-tools:2.0 module
• Red Hat Enterprise Linux 7 Extras update for podman
• Red Hat Enterprise Linux 7 Extras update for buildah
• Path traversal in buildah (Alpine package)
• SUSE update for buildah
• SUSE update for buildah
• SUSE update for buildah
• SUSE update for buildah
• SUSE update for buildah
• Red Hat OpenShift Container Platform 4.3 update for podman
• Path traversal in Red Hat OpenShift Container Platform 4.2
• Path traversal in Red Hat OpenShift Container Platform 4.1