CVE-2020-10696
Summary
| CVE | CVE-2020-10696 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-03-31 22:15:00 UTC |
|---|
| Updated | 2023-11-07 03:14:00 UTC |
|---|
| Description | A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| 1817651 – (CVE-2020-10696) CVE-2020-10696 buildah: Crafted input tar file may lead to local file overwrite during image build process |
CONFIRM |
bugzilla.redhat.com |
Exploit, Issue Tracking, Patch, Third Party Advisory |
| Red Hat Customer Portal |
MISC |
access.redhat.com |
Third Party Advisory |
| Fix potential CVE in tarfile w/ symlink by TomSweeneyRedHat · Pull Request #2245 · containers/buildah · GitHub |
MISC |
github.com |
Exploit, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 377377 Alibaba Cloud Linux Security Update for container-tools:rhel8 (ALINUX3-SA-2021:0013)
- 501807 Alpine Linux Security Update for buildah
- 504589 Alpine Linux Security Update for buildah
- 750353 OpenSUSE Security Update for buildah, libcontainers-common, podman (openSUSE-SU-2021:0310-1)
- 750534 OpenSUSE Security Update for buildah (openSUSE-SU-2020:2106-1)
- 751850 OpenSUSE Security Update for buildah (openSUSE-SU-2022:0770-1)
- 752641 SUSE Enterprise Linux Security Update for buildah (SUSE-SU-2022:3480-1)
- 752726 SUSE Enterprise Linux Security Update for buildah (SUSE-SU-2022:3766-1)
- 752967 SUSE Enterprise Linux Security Update for buildah (SUSE-SU-2022:4350-1)
- 752975 SUSE Enterprise Linux Security Update for buildah (SUSE-SU-2022:4349-1)
- 753101 SUSE Enterprise Linux Security Update for buildah (SUSE-SU-2022:0770-1)
- 753242 SUSE Enterprise Linux Security Update for buildah (SUSE-SU-2022:3655-1)
- 770021 Red Hat OpenShift Container Platform 4.3.12 Security Update (RHSA-2020:1396)
- 770022 Red Hat OpenShift Container Platform 4.2.28 Security Update (RHSA-2020:1401)
- 770023 Red Hat OpenShift Container Platform 4.1.41 Security Update (RHSA-2020:1449)
- 940495 AlmaLinux Security Update for container-tools:2.0 (ALSA-2020:1931)
- 940502 AlmaLinux Security Update for container-tools:rhel8 (ALSA-2020:1932)
- 940510 AlmaLinux Security Update for container-tools:1.0 (ALSA-2020:1926)
- 960768 Rocky Linux Security Update for container-tools:rhel8 (RLSA-2020:1932)
- 960775 Rocky Linux Security Update for container-tools:2.0 (RLSA-2020:1931)
- 960859 Rocky Linux Security Update for container-tools:1.0 (RLSA-2020:1926)
- 982559 Go (go) Security Update for github.com/containers/buildah/imagebuildah (GHSA-fx8w-mjvm-hvpc)
