A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.

#1podman build ..." follows symlinks when reading .containerignore and .dockerignore We've received this potential security issue with Podman, and although not said, it's really in Buildah. I've asked one of our engineers (Aditya) to fix it upstream, but I think it might be wise to backport to Podman 4.1.1 as noted in the issue.

Please adivise next steps and setup any CVE's or BZ's as appropriate. more information in SNow -> https://redhat.service-now.com/surl.do?n=INC2395282