id: GO-2022-0417
modules:
    - module: github.com/containers/buildah
      versions:
        - fixed: 1.25.0
      vulnerable_at: 1.24.0
      packages:
        - package: github.com/containers/buildah
          symbols:
            - setupCapAdd
            - setupCapDrop
          derived_symbols:
            - Builder.Run
        - package: github.com/containers/buildah/chroot
          symbols:
            - setCapabilities
summary: Incorrect default permissions in github.com/containers/buildah
description: |-
    Containers are created with non-empty inheritable Linux process capabilities,
    permitting programs with inheritable file capabilities to elevate those
    capabilities to the permitted set during execve(2).

    This bug does not affect the container security sandbox, as the inheritable set
    never contains more capabilities than are included in the container's bounding
    set.
published: 2022-07-01T20:08:10Z
cves:
    - CVE-2022-27651
ghsas:
    - GHSA-c3g4-w6cv-6v7h
references:
    - fix: https://github.com/containers/buildah/commit/e7e55c988c05dd74005184ceb64f097a0cfe645b
    - web: https://bugzilla.redhat.com/show_bug.cgi?id=2066840