vuln-ubuntu/data/osv/cve/2021/UBUNTU-CVE-2021-3602.json

{
  "schema_version": "1.7.0",
  "id": "UBUNTU-CVE-2021-3602",
  "details": "An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).",
  "aliases": [],
  "upstream": [
    "CVE-2021-3602"
  ],
  "related": [],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
    },
    {
      "type": "Ubuntu",
      "score": "medium"
    }
  ],
  "published": "2022-03-03T19:15:00Z",
  "modified": "2026-10-17T09:07:57Z",
  "affected": [
    {
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "golang-github-containers-buildah",
        "purl": "pkg:deb/ubuntu/golang-github-containers-buildah@1.23.1+ds1-2?arch=source&distro=jammy"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "versions": [
        "1.21.3+ds1-1ubuntu1",
        "1.23.1+ds1-2"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "buildah",
            "binary_version": "1.23.1+ds1-2"
          },
          {
            "binary_name": "golang-github-containers-buildah-dev",
            "binary_version": "1.23.1+ds1-2"
          }
        ]
      }
    },
    {
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "golang-github-containers-buildah",
        "purl": "pkg:deb/ubuntu/golang-github-containers-buildah@1.33.7+ds1-1ubuntu0.24.04.3+esm3?arch=source&distro=esm-apps/noble"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "versions": [
        "1.28.2+ds1-3build1",
        "1.32.2+ds1-1",
        "1.33.1+ds1-2",
        "1.33.3+ds1-2",
        "1.33.5+ds1-4",
        "1.33.5+ds1-4build1",
        "1.33.5+ds1-4build2",
        "1.33.7+ds1-1",
        "1.33.7+ds1-1ubuntu0.24.04.1",
        "1.33.7+ds1-1ubuntu0.24.04.2",
        "1.33.7+ds1-1ubuntu0.24.04.2+esm1",
        "1.33.7+ds1-1ubuntu0.24.04.2+esm2",
        "1.33.7+ds1-1ubuntu0.24.04.3",
        "1.33.7+ds1-1ubuntu0.24.04.3+esm2",
        "1.33.7+ds1-1ubuntu0.24.04.3+esm3"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "buildah",
            "binary_version": "1.33.7+ds1-1ubuntu0.24.04.3+esm3"
          },
          {
            "binary_name": "golang-github-containers-buildah-dev",
            "binary_version": "1.33.7+ds1-1ubuntu0.24.04.3+esm3"
          }
        ]
      }
    },
    {
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "golang-github-containers-buildah",
        "purl": "pkg:deb/ubuntu/golang-github-containers-buildah@1.39.3+ds1-1syncable1?arch=source&distro=questing"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "versions": [
        "1.39.3+ds1-1syncable1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "buildah",
            "binary_version": "1.39.3+ds1-1syncable1"
          },
          {
            "binary_name": "golang-github-containers-buildah-dev",
            "binary_version": "1.39.3+ds1-1syncable1"
          }
        ]
      }
    },
    {
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "golang-github-containers-buildah",
        "purl": "pkg:deb/ubuntu/golang-github-containers-buildah@1.43.2+ds1-3?arch=source&distro=stonking"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "versions": [
        "1.42.1+ds1-2build1",
        "1.43.2+ds1-3"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "buildah",
            "binary_version": "1.43.2+ds1-3"
          },
          {
            "binary_name": "golang-github-containers-buildah-dev",
            "binary_version": "1.43.2+ds1-3"
          }
        ]
      }
    },
    {
      "package": {
        "ecosystem": "Ubuntu:Pro:26.04:LTS",
        "name": "golang-github-containers-buildah",
        "purl": "pkg:deb/ubuntu/golang-github-containers-buildah@1.42.1+ds1-2ubuntu0.26.04.1~esm1?arch=source&distro=esm-apps/resolute"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "versions": [
        "1.39.3+ds1-1syncable1",
        "1.42.1+ds1-2",
        "1.42.1+ds1-2build1",
        "1.42.1+ds1-2ubuntu0.26.04.1~esm1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "buildah",
            "binary_version": "1.42.1+ds1-2ubuntu0.26.04.1~esm1"
          },
          {
            "binary_name": "golang-github-containers-buildah-dev",
            "binary_version": "1.42.1+ds1-2ubuntu0.26.04.1~esm1"
          }
        ]
      }
    }
  ],
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-3602"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjj"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/containers/buildah/commit/23c478b815fb93c094070baa336bcb6a27c01683"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/containers/buildah/commit/f4f2a7fc78fa4f12e2f6e6c4ab450aae0d182f3e"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3602"
    }
  ]
}