CVE-2022-2990
First published: Mon Aug 22 2022(Updated: )
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/buildah | <1:1.27.0-2.el9 | 1:1.27.0-2.el9 |
| redhat/podman | <2:4.2.0-7.el9_1 | 2:4.2.0-7.el9_1 |
| redhat/buildah | <1:1.29.1-1.rhaos4.13.el9 | 1:1.29.1-1.rhaos4.13.el9 |
| Buildah Project Buildah | <1.27.1 | |
| Redhat Openshift Container Platform | =4.0 | |
| Redhat Enterprise Linux | =7.0 | |
| Redhat Enterprise Linux | =8.0 | |
| Redhat Enterprise Linux | =9.0 | |
| go/github.com/containers/buildah | <1.27.1 | 1.27.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2022-2990
- https://bugzilla.redhat.com/show_bug.cgi?id=2121453
- https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
- https://github.com/containers/buildah/pull/4200
- https://github.com/containers/buildah/commit/4a8bf740e862f2438279c6feee2ea59ddf0cda0b
- https://access.redhat.com/security/cve/CVE-2022-2990
- https://pkg.go.dev/vuln/GO-2022-1008
- https://github.com/advisories/GHSA-fjm8-m7m6-2fjp (Advisory)
- https://access.redhat.com/errata/RHSA-2022:7457
- https://access.redhat.com/errata/RHSA-2022:7822
- https://access.redhat.com/errata/RHSA-2022:8008
- https://access.redhat.com/errata/RHSA-2022:8431
- https://access.redhat.com/security/cve/cve-2022-2990
- https://access.redhat.com/errata/RHSA-2023:1325
- https://www.cve.org/CVERecord?id=CVE-2022-2990 https://nvd.nist.gov/vuln/detail/CVE-2022-2990 https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-2990?
CVE-2022-2990 is a vulnerability in the Buildah container engine that could lead to the disclosure of sensitive information or possible data modification.
How severe is CVE-2022-2990?
CVE-2022-2990 has a severity rating of 7.1 (High).
What software is affected by CVE-2022-2990?
The Buildah container engine versions 1.27.0-2.el9 and 1.29.1-1.rhaos4.13.el9, Podman version 4.2.0-7.el9_1, Red Hat Openshift Container Platform 4.0, and Red Hat Enterprise Linux versions 7.0, 8.0, and 9.0 are affected by CVE-2022-2990.
How can I mitigate CVE-2022-2990?
To mitigate CVE-2022-2990, it is recommended to apply the appropriate patches or updates provided by the respective vendors.
Where can I find more information about CVE-2022-2990?
You can find more information about CVE-2022-2990 at the following references: [CVE](https://www.cve.org/CVERecord?id=CVE-2022-2990), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-2990), [Bentham's Gaze](https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2121453), and [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2022:7457).
- collector/redhat-cve
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-2990
- collector/nvd-cve
- collector/nvd-index
- collector/github-advisory
- alias/GHSA-fjm8-m7m6-2fjp
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- package-manager/redhat
- vendor/buildah project
- canonical/buildah project buildah
- vendor/redhat
- canonical/redhat openshift container platform
- version/redhat openshift container platform/4.0
- canonical/redhat enterprise linux
- version/redhat enterprise linux/7.0
- version/redhat enterprise linux/8.0
- version/redhat enterprise linux/9.0
- package-manager/go