Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification
Summary
Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification
Original description
The description as published by the source.
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-2990 golang-github-containers-buildah
- Ubuntu UBUNTU-CVE-2022-2990 golang-github-containers-buildah
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web access.redhat.com
- web bugzilla.redhat.com
- web pkg.go.dev
- web benthamsgaze.org