CVE catalog

CVE-2022-2990

golang-github-containers-buildah: CVE-2022-2990

[CVE catalog]

Severity
High · CVSS 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.35% · Oct 25, 2026

An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-containers-buildahsid1.43.2+ds1-3fixed
Debiangolang-github-containers-buildahforky1.43.2+ds1-3fixed
Debiangolang-github-containers-buildahtrixie1.39.3+ds1-1fixed
Debiangolang-github-containers-buildahbookworm1.28.2+ds1-3+deb12u1fixed
Opensusebuildahtumbleweed1.27.0-3.1fixed
Susebuildahlinux enterprise high performance computing 15 sp1-ltss1.25.1-150100.3.20.15fixed
Susebuildahlinux enterprise high performance computing 15 sp2-ltss1.25.1-150100.3.20.15fixed
Susebuildahlinux enterprise server 15 sp1-ltss1.25.1-150100.3.20.15fixed
Susebuildahlinux enterprise server 15 sp2-ltss1.25.1-150100.3.20.15fixed
Susebuildahlinux enterprise server for sap applications 15 sp11.25.1-150100.3.20.15fixed
Susebuildahlinux enterprise server for sap applications 15 sp21.25.1-150100.3.20.15fixed
Susebuildahenterprise storage 71.25.1-150100.3.20.15fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-containers-buildahsourcesid1.28.0+ds1-2not yet assignedNot reportedNot reported
Debiangolang-github-containers-buildahsourceforky1.28.0+ds1-2not yet assignedNot reportedNot reported
Debiangolang-github-containers-buildahsourcetrixie1.28.0+ds1-2not yet assignedNot reportedNot reported
Debiangolang-github-containers-buildahsourcebookworm1.28.0+ds1-2not yet assignedNot reportedNot reported
Opensusebuildahrpmtumbleweed1.27.0-3.1Not reportedOPENSUSE-SU-2024:12289-1Not reported
Susebuildahrpmlinux enterprise high performance computing 15 sp1-ltss1.25.1-150100.3.20.15Not reportedSUSE-SU-2023:4099-1Not reported
Susebuildahrpmlinux enterprise high performance computing 15 sp2-ltss1.25.1-150100.3.20.15Not reportedSUSE-SU-2023:4099-1Not reported
Susebuildahrpmlinux enterprise server 15 sp1-ltss1.25.1-150100.3.20.15Not reportedSUSE-SU-2023:4099-1Not reported
Susebuildahrpmlinux enterprise server 15 sp2-ltss1.25.1-150100.3.20.15Not reportedSUSE-SU-2023:4099-1Not reported
Susebuildahrpmlinux enterprise server for sap applications 15 sp11.25.1-150100.3.20.15Not reportedSUSE-SU-2023:4099-1Not reported
Susebuildahrpmlinux enterprise server for sap applications 15 sp21.25.1-150100.3.20.15Not reportedSUSE-SU-2023:4099-1Not reported
Susebuildahrpmenterprise storage 71.25.1-150100.3.20.15Not reportedSUSE-SU-2023:4099-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [buildah]Fixed

    Source package: [golang-github-containers-buildah]

    Details (2)

    • 1.28.2+ds1-3+deb12u1+b3 · amd64 · bookworm

      Fixed · Fixed: 1.28.0+ds1-2

      dsa · golang-github-containers-buildah · debian · bookworm

    • 1.28.2+ds1-3+deb12u1+b3 · arm64 · bookworm

      Fixed · Fixed: 1.28.0+ds1-2

      dsa · golang-github-containers-buildah · debian · bookworm

  • [golang-github-containers-buildah-dev]Fixed

    Source package: [golang-github-containers-buildah]

    Details (2)

    • 1.28.2+ds1-3+deb12u1 · all · bookworm

      Fixed · Fixed: 1.28.0+ds1-2

      dsa · golang-github-containers-buildah · debian · bookworm

    • 1.28.2+ds1-3+deb12u1 · all · bookworm

      Fixed · Fixed: 1.28.0+ds1-2

      dsa · golang-github-containers-buildah · debian · bookworm

[openSUSE Tumbleweed]

  • [buildah]Fixed

    Source package: [buildah]

    Details (1)

    • 1.44.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.27.0-3.1

      dsa · buildah · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]