GHSA-fhqq-8f65-5xfc

Suggest an improvement
Source
https://github.com/advisories/GHSA-fhqq-8f65-5xfc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-fhqq-8f65-5xfc/GHSA-fhqq-8f65-5xfc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fhqq-8f65-5xfc
Aliases
  • CVE-2024-9407
Published
2024-10-01T21:31:35Z
Modified
2024-10-01T23:27:06.786563Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Improper Input Validation in Buildah and Podman
Details

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

References

Affected packages

Go / github.com/containers/buildah

Package

Name
github.com/containers/buildah
View open source insights on deps.dev
Purl
pkg:golang/github.com/containers/buildah

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
1.37.3

Go / github.com/containers/podman/v5

Package

Name
github.com/containers/podman/v5
View open source insights on deps.dev
Purl
pkg:golang/github.com/containers/podman/v5

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
5.2.3