A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/cve-2020-10696 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10696 | Exploit Issue Tracking Patch Third Party Advisory |
| https://github.com/containers/buildah/pull/2245 | Exploit Third Party Advisory |
| https://access.redhat.com/security/cve/cve-2020-10696 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10696 | Exploit Issue Tracking Patch Third Party Advisory |
| https://github.com/containers/buildah/pull/2245 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 04:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/security/cve/cve-2020-10696 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10696 - Exploit, Issue Tracking, Patch, Third Party Advisory | |
| References | () https://github.com/containers/buildah/pull/2245 - Exploit, Third Party Advisory |
Information
Published : 2020-03-31 22:15
Updated : 2024-11-21 04:55
NVD link : CVE-2020-10696
Mitre link : CVE-2020-10696
CVE.ORG link : CVE-2020-10696
JSON object : View
Products Affected
redhat
- enterprise_linux
- openshift_container_platform
buildah_project
- buildah
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')