Catálogo de CVE

CVE-2022-27651

golang-github-containers-buildah affected and fixed versions

[Catálogo de CVE]

A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.

Gravedad
Medium · CVSS 5.9CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.26% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixiegolang-github-containers-buildah1.28.0+ds1-2FixedDistribution-reported fixed boundary[CVE-2022-27651]
Debiantrixiegolang-github-containers-buildah1.39.3+ds1-1Fixed[CVE-2022-27651]
Debiansidgolang-github-containers-buildah1.28.0+ds1-2FixedDistribution-reported fixed boundary[CVE-2022-27651]
Debiansidgolang-github-containers-buildah1.43.2+ds1-3Fixed[CVE-2022-27651]
Debianforkygolang-github-containers-buildah1.28.0+ds1-2FixedDistribution-reported fixed boundary[CVE-2022-27651]
Debianforkygolang-github-containers-buildah1.43.2+ds1-3Fixed[CVE-2022-27651]
Debianbookwormgolang-github-containers-buildah1.28.0+ds1-2FixedDistribution-reported fixed boundary[CVE-2022-27651]
Debianbookwormgolang-github-containers-buildah1.28.2+ds1-3+deb12u1Fixed[CVE-2022-27651]

Showing 8 fix observations. All 13 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormgolang-github-containers-buildah1.28.0+ds1-2FixedDistribution-reported fixed boundary[CVE-2022-27651]
Debianbookwormgolang-github-containers-buildah1.28.2+ds1-3+deb12u1Fixed[CVE-2022-27651]
Debianforkygolang-github-containers-buildah1.28.0+ds1-2FixedDistribution-reported fixed boundary[CVE-2022-27651]
Debianforkygolang-github-containers-buildah1.43.2+ds1-3Fixed[CVE-2022-27651]
Debiansidgolang-github-containers-buildah1.28.0+ds1-2FixedDistribution-reported fixed boundary[CVE-2022-27651]
Debiansidgolang-github-containers-buildah1.43.2+ds1-3Fixed[CVE-2022-27651]
Debiantrixiegolang-github-containers-buildah1.28.0+ds1-2FixedDistribution-reported fixed boundary[CVE-2022-27651]
Debiantrixiegolang-github-containers-buildah1.39.3+ds1-1Fixed[CVE-2022-27651]
Opensuseleap 15.3buildah1.25.1-150300.8.6.1UnknownSource applicability is not established[SUSE-SU-2022:1437-1]
Opensuseleap 15.4buildah1.25.1-150400.3.3.28UnknownSource applicability is not established[SUSE-SU-2022:2680-1]
Opensusetumbleweedbuildah1.25.1-1.1UnknownSource applicability is not established[OPENSUSE-SU-2024:11964-1]
Suselinux enterprise module for containers 15 sp3buildah1.25.1-150300.8.6.1UnknownSource applicability is not established[SUSE-SU-2022:1437-1]
Suselinux enterprise module for containers 15 sp4buildah1.25.1-150400.3.3.28UnknownSource applicability is not established[SUSE-SU-2022:2680-1]
Original provider fields
{
  "package_releases": [
    {
      "name": "golang-github-containers-buildah",
      "status": "fixed",
      "release": "sid",
      "version": "1.43.2+ds1-3"
    },
    {
      "name": "golang-github-containers-buildah",
      "status": "fixed",
      "release": "forky",
      "version": "1.43.2+ds1-3"
    },
    {
      "name": "golang-github-containers-buildah",
      "status": "fixed",
      "release": "trixie",
      "version": "1.39.3+ds1-1"
    },
    {
      "name": "golang-github-containers-buildah",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.28.2+ds1-3+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1009882,
      "name": "golang-github-containers-buildah",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.28.0+ds1-2"
    },
    {
      "bug": 1009882,
      "name": "golang-github-containers-buildah",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.28.0+ds1-2"
    },
    {
      "bug": 1009882,
      "name": "golang-github-containers-buildah",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1.28.0+ds1-2"
    },
    {
      "bug": 1009882,
      "name": "golang-github-containers-buildah",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.28.0+ds1-2"
    }
  ],
  "distribution_packages": [
    {
      "name": "buildah",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25.1-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:11964-1",
      "fixed_version": "1.25.1-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:11964-1",
      "provider_updated_at": "2026-02-04T04:17:58.035501Z",
      "applicability_unknown": true
    },
    {
      "name": "buildah",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25.1-150400.3.3.28"
            }
          ]
        }
      ],
      "release": "linux enterprise module for containers 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2680-1",
      "fixed_version": "1.25.1-150400.3.3.28",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2680-1",
      "provider_updated_at": "2026-02-04T03:51:23.328220Z",
      "applicability_unknown": true
    },
    {
      "name": "buildah",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25.1-150400.3.3.28"
            }
          ]
        }
      ],
      "release": "leap 15.4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2680-1",
      "fixed_version": "1.25.1-150400.3.3.28",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2680-1",
      "provider_updated_at": "2026-02-04T03:51:23.328220Z",
      "applicability_unknown": true
    },
    {
      "name": "buildah",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25.1-150300.8.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for containers 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1437-1",
      "fixed_version": "1.25.1-150300.8.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1437-1",
      "provider_updated_at": "2026-02-04T03:37:03.474775Z",
      "applicability_unknown": true
    },
    {
      "name": "buildah",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25.1-150300.8.6.1"
            }
          ]
        }
      ],
      "release": "leap 15.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:1437-1",
      "fixed_version": "1.25.1-150300.8.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:1437-1",
      "provider_updated_at": "2026-02-04T03:37:03.474775Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1009882]

OpenFactory catalog packages

La asociación de paquetes está en curso.

[Debian 12 (Bookworm)]

  • [buildah]Desconocido

    Paquete fuente: [golang-github-containers-buildah]

    Detalles (2)

    • 1.28.2+ds1-3+deb12u1+b3 · amd64 · bookworm

      Corregida · Corregida: 1.28.0+ds1-2

      dsa · golang-github-containers-buildah · debian · bookworm

    • 1.28.2+ds1-3+deb12u1+b3 · arm64 · bookworm

      Corregida · Corregida: 1.28.0+ds1-2

      dsa · golang-github-containers-buildah · debian · bookworm

  • [golang-github-containers-buildah-dev]Desconocido

    Paquete fuente: [golang-github-containers-buildah]

    Detalles (2)

    • 1.28.2+ds1-3+deb12u1 · all · bookworm

      Corregida · Corregida: 1.28.0+ds1-2

      dsa · golang-github-containers-buildah · debian · bookworm

    • 1.28.2+ds1-3+deb12u1 · all · bookworm

      Corregida · Corregida: 1.28.0+ds1-2

      dsa · golang-github-containers-buildah · debian · bookworm

[openSUSE Tumbleweed]

  • [buildah]Desconocido

    Paquete fuente: [buildah]

    Detalles (1)

    • 1.44.0-1.1 · x86_64 · tumbleweed

      Corregida · Corregida: 1.25.1-1.1

      dsa · buildah · opensuse · tumbleweed

Observado:

Referencias

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]