data/reports/GO-2022-0417.yaml

modules:
  - module: github.com/containers/buildah
    versions:
      - fixed: 1.25.0
    vulnerable_at: 1.24.0
    packages:
      - package: github.com/containers/buildah
        symbols:
          - setupCapAdd
          - setupCapDrop
        derived_symbols:
          - Builder.Run
      - package: github.com/containers/buildah/chroot
        symbols:
          - setCapabilities
description: |
    Containers are created with non-empty inheritable Linux process
    capabilities, permitting programs with inheritable file capabilities
    to elevate those capabilities to the permitted set during execve(2).

    This bug does not affect the container security sandbox, as the
    inheritable set never contains more capabilities than are included
    in the container's bounding set.
published: 2022-07-01T20:08:10Z
cves:
  - CVE-2022-27651
ghsas:
  - GHSA-c3g4-w6cv-6v7h
references:
  - fix: https://github.com/containers/buildah/commit/e7e55c988c05dd74005184ceb64f097a0cfe645b
  - web: https://bugzilla.redhat.com/show_bug.cgi?id=2066840