DEBIAN-CVE-2026-44517

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-44517

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44517.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-44517

Upstream

CVE-2026-44517

Published

2026-08-21T21:16:59Z

Modified

2026-09-14T17:03:13Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0.

References

https://security-tracker.debian.org/tracker/CVE-2026-44517

Affected packages

Debian:13 / golang-github-containers-buildah

Package

Name: golang-github-containers-buildah
Purl: pkg:deb/debian/golang-github-containers-buildah?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.39.3+ds1-1

1.41.4+ds1-1

1.41.4+ds1-2

1.41.4+ds1-3

1.41.5+ds1-1

1.41.5+ds1-2

1.41.5+ds1-3

1.41.5+ds1-4

1.42.1+ds1-1

1.42.1+ds1-2

1.43.0+ds1-1

1.43.0+ds1-2

1.43.1+ds1-1

1.43.1+ds1-2

1.43.1+ds1-3

1.43.2+ds1-1

1.43.2+ds1-2

1.43.2+ds1-3

1.45.0+ds1-1

1.45.0+ds1-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44517.json"

Debian:14 / golang-github-containers-buildah