{
  "schema_version": "1.3.1",
  "id": "GO-2022-0417",
  "modified": "0001-01-01T00:00:00Z",
  "published": "2022-07-01T20:08:10Z",
  "aliases": [
    "CVE-2022-27651",
    "GHSA-c3g4-w6cv-6v7h"
  ],
  "summary": "Incorrect default permissions in github.com/containers/buildah",
  "details": "Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2).\n\nThis bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than are included in the container's bounding set.",
  "affected": [
    {
      "package": {
        "name": "github.com/containers/buildah",
        "ecosystem": "Go"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25.0"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "imports": [
          {
            "path": "github.com/containers/buildah",
            "symbols": [
              "Builder.Run",
              "setupCapAdd",
              "setupCapDrop"
            ]
          },
          {
            "path": "github.com/containers/buildah/chroot",
            "symbols": [
              "setCapabilities"
            ]
          }
        ]
      }
    }
  ],
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/containers/buildah/commit/e7e55c988c05dd74005184ceb64f097a0cfe645b"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066840"
    }
  ],
  "database_specific": {
    "url": "https://pkg.go.dev/vuln/GO-2022-0417"
  }
}