CVE-2022-2990
Summary
| CVE | CVE-2022-2990 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-09-13 14:15:00 UTC |
|---|
| Updated | 2023-02-12 22:15:00 UTC |
|---|
| Description | An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Red Hat Customer Portal - Access to 24x7 support and knowledge |
MISC |
access.redhat.com |
|
| Vulnerability in Linux containers – investigation and mitigation – Bentham’s Gaze |
MISC |
www.benthamsgaze.org |
|
| 2121453 – (CVE-2022-2990) CVE-2022-2990 buildah: possible information disclosure and modification |
MISC |
bugzilla.redhat.com |
|
| Red Hat Customer Portal - Access to 24x7 support and knowledge |
MISC |
access.redhat.com |
|
| Red Hat Customer Portal - Access to 24x7 support and knowledge |
MISC |
access.redhat.com |
|
| Red Hat Customer Portal - Access to 24x7 support and knowledge |
MISC |
access.redhat.com |
|
| Red Hat Customer Portal - Access to 24x7 support and knowledge |
MISC |
access.redhat.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160233 Oracle Enterprise Linux Security Update for container-tools:ol8 (ELSA-2022-7457)
- 160285 Oracle Enterprise Linux Security Update for buildah (ELSA-2022-8008)
- 160318 Oracle Enterprise Linux Security Update for container-tools:ol8 (ELSA-2022-7822)
- 160323 Oracle Enterprise Linux Security Update for podman (ELSA-2022-8431)
- 183653 Debian Security Update for golang-github-containers-buildah (CVE-2022-2990)
- 240829 Red Hat Update for container-tools:rhel8 security (RHSA-2022:7457)
- 240848 Red Hat Update for container-tools:rhel8 security (RHSA-2022:7822)
- 240894 Red Hat Update for buildah (RHSA-2022:8008)
- 240912 Red Hat Update for podman security (RHSA-2022:8431)
- 241546 Red Hat OpenShift Container Platform 4.13 Security Update (RHSA-2023:1325)
- 502821 Alpine Linux Security Update for buildah
- 752726 SUSE Enterprise Linux Security Update for buildah (SUSE-SU-2022:3766-1)
- 752967 SUSE Enterprise Linux Security Update for buildah (SUSE-SU-2022:4350-1)
- 752975 SUSE Enterprise Linux Security Update for buildah (SUSE-SU-2022:4349-1)
- 753242 SUSE Enterprise Linux Security Update for buildah (SUSE-SU-2022:3655-1)
- 755103 SUSE Enterprise Linux Security Update for buildah (SUSE-SU-2023:4099-1)
- 770186 Red Hat OpenShift Container Platform 4.13 Security Update (RHSA-2023:1325)
- 903948 Common Base Linux Mariner (CBL-Mariner) Security Update for buildah (10960)
- 904605 Common Base Linux Mariner (CBL-Mariner) Security Update for buildah (11514)
- 907337 Common Base Linux Mariner (CBL-Mariner) Security Update for buildah (10960-1)
- 940780 AlmaLinux Security Update for container-tools:rhel8 (ALSA-2022:7822)
- 940785 AlmaLinux Security Update for podman (ALSA-2022:8431)
- 940827 AlmaLinux Security Update for buildah (ALSA-2022:8008)
- 960172 Rocky Linux Security Update for container-tools:rhel8 (RLSA-2022:7457)
- 960180 Rocky Linux Security Update for container-tools:rhel8 (RLSA-2022:7822)
