Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah
Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation.
02 / AFFECTED SOFTWARE
Affected packages
04 / EVIDENCE
Source records
### Impact When processing a build contexts or `add`/`copy` instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build. ### Patches Fixed in Buildah 1.44 and 1.43.2.
Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation.
05 / REFERENCES