This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-10696 →

DEBIAN-CVE-2020-10696

A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container...

Original description

The description as published by the source.

A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 golang-github-containers-buildah

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.6-2"}]}]

Debian:13 golang-github-containers-buildah

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.6-2"}]}]

Debian:14 golang-github-containers-buildah

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.6-2"}]}]

References

advisory security-tracker.debian.org