CVE-2020-10696: Path Traversal

Q: What is CVE-2020-10696?

CVE-2020-10696 is a path traversal vulnerability found in Buildah.

Q: How does CVE-2020-10696 affect Buildah?

CVE-2020-10696 allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.

Q: What is the severity level of CVE-2020-10696?

CVE-2020-10696 has a severity level of 8.8 (high).

Q: Which versions of Buildah are affected by CVE-2020-10696?

Versions of Buildah before 1.14.5 are affected by CVE-2020-10696.

Q: How can I fix CVE-2020-10696 in Buildah?

To fix CVE-2020-10696 in Buildah, update to version 1.14.5 or later.

Published Mar 26, 2020

Updated

A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.

Other sources

A path traversal flaw was found in Buildah. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.

During buildah image building process a crafted tar file containing symlinks may lead buildah to overwrite any file which the running uid have write permissions, compromising confidentiality, integrity and possibly allowing code execution.

— Red Hat

Affected Software

11 affected componentsFixes available

redhat/buildah<0:1.11.6-11.el7_8

0:1.11.6-11.el7_8

redhat/podman<0:1.6.4-18.el7_8

0:1.6.4-18.el7_8

redhat/podman<0:1.0.2-4.dev.git96ccc2e.rhaos4.1.el8

0:1.0.2-4.dev.git96ccc2e.rhaos4.1.el8

redhat/podman<0:1.4.2-6.rhaos4.2.el8

0:1.4.2-6.rhaos4.2.el8

redhat/podman<0:1.6.4-10.rhaos4.3.el8

0:1.6.4-10.rhaos4.3.el8

redhat/buildah<1.14.5

1.14.5

go/github.com/containers/buildah<1.14.4

1.14.4

Buildah Project Buildah<1.14.5

redhat OpenShift Container Platform=3.11

redhat Enterprise Linux=7.0

redhat Enterprise Linux=8.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/buildah to a version that resolves this vulnerability.
Fixed in 0:1.11.6-11.el7_8
Upgrade
Upgrade redhat/podman to a version that resolves this vulnerability.
Fixed in 0:1.6.4-18.el7_8
Upgrade
Upgrade redhat/podman to a version that resolves this vulnerability.
Fixed in 0:1.0.2-4.dev.git96ccc2e.rhaos4.1.el8
Upgrade
Upgrade redhat/podman to a version that resolves this vulnerability.
Fixed in 0:1.4.2-6.rhaos4.2.el8
Upgrade
Upgrade redhat/podman to a version that resolves this vulnerability.
Fixed in 0:1.6.4-10.rhaos4.3.el8
Upgrade
Upgrade go/github.com/containers/buildah to a version that resolves this vulnerability.
Fixed in 1.14.4
Upgrade
Upgrade redhat/buildah to a version that resolves this vulnerability.
Fixed in 1.14.5
Upgrade
Upgrade Buildah to a version that resolves this vulnerability.
Fixed in 1.14.5

Event History

Mar 26, 2020

CVE Published

12:00 AM

Data Sourced

via Red Hat·05:49 PM

DescriptionSeverityAffected Software

Mar 31, 2020

CVE Published

via MITRE·09:01 PM

Data Sourced

via MITRE·09:01 PM

DescriptionSeverityWeakness

May 18, 2021

Advisory Published

via GitHub·06:32 PM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2020-10696?