CVE-2022-4123: Path Traversal
A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
Other sources
This flaw was found in Buildah via podman,. > Type: information disclosure of a local absolute path > > Severity: very low. (A local path is not that sensitive information). > Feel free to just disregard this report if you think this issue has > too low importance. > > Summary: Podman may disclose the absolute path of an empty context dir > when running "podman --remote build -t test1 -f /tmp/Dockerfile > emptydir". The path could be logged in the container image. (The > lowest subdirectory of the absolute path might not be disclosed, see > discussion below) > > The issue was introduced in > https://github.com/containers/podman/pull/13531 > that went into the Podman release v4.1.0-rc1 >
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-4123?
CVE-2022-4123 is a vulnerability found in Buildah that could result in the disclosure of the local path and lowest subdirectory, impacting confidentiality.
What is the severity of CVE-2022-4123?
The severity of CVE-2022-4123 is low, with a severity rating of 3.3.
Which software is affected by CVE-2022-4123?
The affected software includes Podman (versions 4.1.0 to 4.4.1) and Fedora (versions 35 to 37).
How can I fix CVE-2022-4123?
To fix CVE-2022-4123, it is recommended to upgrade to a patched version of Podman or Fedora, depending on the affected software.
Where can I find more information about CVE-2022-4123?
You can find more information about CVE-2022-4123 in the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-4123), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2144989), [GitHub Issue](https://github.com/containers/podman/issues/13293).