ALPINE-CVE-2021-3602

See a problem?
Please try reporting it to the source first.

Source

https://security.alpinelinux.org/vuln/CVE-2021-3602

Import Source

https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json

JSON Data

https://api.osv.dev/v1/vulns/ALPINE-CVE-2021-3602

Upstream

CVE-2021-3602

Published

2022-03-03T19:15:08Z

Modified

2026-11-03T06:32:40Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).

References

https://security.alpinelinux.org/vuln/CVE-2021-3602

Affected packages

Alpine:v3.14

buildah

Package

Name: buildah
Purl: pkg:apk/alpine/buildah?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.17.0

Fixed

1.21.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

podman

Package

Name: podman
Purl: pkg:apk/alpine/podman?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

Alpine:v3.15

buildah

Package

Name: buildah
Purl: pkg:apk/alpine/buildah?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.17.0

Fixed

1.21.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

podman

Package

Name: podman
Purl: pkg:apk/alpine/podman?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

Alpine:v3.16

buildah

Package

Name: buildah
Purl: pkg:apk/alpine/buildah?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.17.0

Fixed

1.21.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

podman

Package

Name: podman
Purl: pkg:apk/alpine/podman?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

Alpine:v3.17

buildah

Package

Name: buildah
Purl: pkg:apk/alpine/buildah?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.17.0

Fixed

1.21.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

podman

Package

Name: podman
Purl: pkg:apk/alpine/podman?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

Alpine:v3.18

buildah

Package

Name: buildah
Purl: pkg:apk/alpine/buildah?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.17.0

Fixed

1.21.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

podman

Package

Name: podman
Purl: pkg:apk/alpine/podman?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

Alpine:v3.19

buildah

Package

Name: buildah
Purl: pkg:apk/alpine/buildah?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.17.0

Fixed

1.21.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

podman

Package

Name: podman
Purl: pkg:apk/alpine/podman?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

Alpine:v3.20

buildah

Package

Name: buildah
Purl: pkg:apk/alpine/buildah?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.17.0

Fixed

1.21.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

podman

Package

Name: podman
Purl: pkg:apk/alpine/podman?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

Alpine:v3.21

buildah

Package

Name: buildah
Purl: pkg:apk/alpine/buildah?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.17.0

Fixed

1.21.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

podman

Package

Name: podman
Purl: pkg:apk/alpine/podman?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

Alpine:v3.22

buildah

Package

Name: buildah
Purl: pkg:apk/alpine/buildah?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.17.0

Fixed

1.21.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

podman

Package

Name: podman
Purl: pkg:apk/alpine/podman?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

Alpine:v3.23

buildah

Package

Name: buildah
Purl: pkg:apk/alpine/buildah?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.17.0

Fixed

1.21.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

podman

Package

Name: podman
Purl: pkg:apk/alpine/podman?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

Alpine:v3.24

buildah

Package

Name: buildah
Purl: pkg:apk/alpine/buildah?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.17.0

Fixed

1.21.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"

podman

Package

Name: podman
Purl: pkg:apk/alpine/podman?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.3-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-3602.json"