CVE-2020-10696: buildah_project buildah

Modified

AliasesRHBA-2020:0582RHSA-2020:1401RHSA-2020:1449+9 more

Published 31-03-2020Last modified 04-08-2024

Vulnerability summary

CVE-2020-10696 is a high (CVSS 9.3) vulnerability in buildah_project buildah. EPSS estimates a 2.68% chance of exploitation in the next 30 days, higher than 85.8% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

2.68%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2github, reference

Advisory lineage

Upstream 0 · Downstream 15 · Related 14

OPENSUSE-SU-2020:2106-1 OPENSUSE-SU-2021:0310-1 OPENSUSE-SU-2022:0770-1 OPENSUSE-SU-2024:10666-1 OPENSUSE-SU-2024:14599-1 RHSA-2020:1396+11 more

Timeline

31-03-2020
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.

CVSS metrics

9 scores · 8 sources · 2 versions

v3.18.8v2.09.3

EPSS trend

Probability

2.68%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

No change 0.00 pp

From 2.68% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

githubUnverified
Buildah
Maturity: poc
referenceUnverified
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat193 products

enterprise_linuxEOL7.0 | 8.0
openshift_container_platform3.11
afterburn< 0:4.1.1-3.rhaos4.2.el8
afterburn-debuginfo< 0:4.1.1-3.rhaos4.2.el8
ansible-asb-modules< 0:0.4.1-1.el7

ansible-kubernetes-modules< 0:0.4.0-8.el7
ansible-runner< 0:1.3.4-2.el7ar
ansible-runner-http< 0:1.0-1.el7ar
apb< 0:2.0.3-2.el7
apb-base-scripts< 0:1.4.2-1.el7
apb-container-scripts< 0:2.0.3-2.el7
apb-devel< 0:2.0.3-2.el7
atomic-enterprise-service-catalog< 1:4.4.0-202004260017.git.1.6957195.el7
atomic-enterprise-service-catalog-svcat< 1:4.4.0-202004260017.git.1.6957195.el7
atomic-openshift-service-idler< 0:4.4.0-202004260017.git.1.e04c72f.el7
buildah< 0:1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca | < 0:1.11.6-7.module+el8.2.0+6369+1f4293b4 | < 0:1.11.6-8.module+el8.2.0+6368+cf16aa14 | < 0:1.11.6-6.rhaos4.4.el8
buildah-debuginfo< 0:1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca | < 0:1.11.6-7.module+el8.2.0+6369+1f4293b4 | < 0:1.11.6-8.module+el8.2.0+6368+cf16aa14 | < 0:1.11.6-6.rhaos4.4.el8
buildah-debugsource< 0:1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca | < 0:1.11.6-7.module+el8.2.0+6369+1f4293b4 | < 0:1.11.6-8.module+el8.2.0+6368+cf16aa14 | < 0:1.11.6-6.rhaos4.4.el8
buildah-tests< 0:1.11.6-7.module+el8.2.0+6369+1f4293b4 | < 0:1.11.6-8.module+el8.2.0+6368+cf16aa14 | < 0:1.11.6-6.rhaos4.4.el8
buildah-tests-debuginfo< 0:1.11.6-7.module+el8.2.0+6369+1f4293b4 | < 0:1.11.6-8.module+el8.2.0+6368+cf16aa14 | < 0:1.11.6-6.rhaos4.4.el8
cockpit-podman< 0:11-1.module+el8.2.0+6369+1f4293b4 | < 0:12-1.module+el8.2.0+6368+cf16aa14
conmon< 2:2.0.6-1.module+el8.2.0+6369+1f4293b4 | < 2:2.0.6-1.module+el8.2.0+6368+cf16aa14 | < 2:2.0.15-1.rhaos4.4.el7 | < 2:2.0.15-1.rhaos4.4.el8
console-login-helper-messages< 0:0.16-1.rhaos4.2.el8
console-login-helper-messages-issuegen< 0:0.16-1.rhaos4.2.el8
console-login-helper-messages-profile< 0:0.16-1.rhaos4.2.el8
container-selinux< 2:2.124.0-1.gitf958d0c.module+el8.2.0+6370+6fb6c8ca | < 2:2.124.0-1.module+el8.2.0+6369+1f4293b4 | < 2:2.124.0-1.module+el8.2.0+6368+cf16aa14
containernetworking-plugins< 0:0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca | < 0:0.8.3-4.module+el8.2.0+6369+1f4293b4 | < 0:0.8.3-5.module+el8.2.0+6368+cf16aa14 | < 0:0.8.2-3.el7 | < 0:0.8.2-2.el8
containernetworking-plugins-debuginfo< 0:0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca | < 0:0.8.3-4.module+el8.2.0+6369+1f4293b4 | < 0:0.8.3-5.module+el8.2.0+6368+cf16aa14 | < 0:0.8.2-3.el7 | < 0:0.8.2-2.el8
containernetworking-plugins-debugsource< 0:0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca | < 0:0.8.3-4.module+el8.2.0+6369+1f4293b4 | < 0:0.8.3-5.module+el8.2.0+6368+cf16aa14 | < 0:0.8.2-2.el8
containers-common< 1:0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca | < 1:0.1.40-9.module+el8.2.0+6373+4950d421 | < 1:0.1.40-11.module+el8.2.0+6374+67f43e89 | < 1:0.1.40-1.rhaos4.3.el7 | < 1:0.1.40-6.rhaos4.4.el8
coreos-installer< 0:0-2.rhaos4.4.gite5aa5dc.el8
coreos-installer-dracut< 0:0-2.rhaos4.4.gite5aa5dc.el8
cri-tools< 0:1.17.0-1.el7 | < 0:1.17.0-2.el8
cri-tools-debuginfo< 0:1.17.0-1.el7 | < 0:1.17.0-2.el8
cri-tools-debugsource< 0:1.17.0-2.el8
crit< 0:3.12-9.module+el8.2.0+6370+6fb6c8ca | < 0:3.12-9.module+el8.2.0+6369+1f4293b4 | < 0:3.12-9.module+el8.2.0+6368+cf16aa14
criu< 0:3.12-9.module+el8.2.0+6370+6fb6c8ca | < 0:3.12-9.module+el8.2.0+6369+1f4293b4 | < 0:3.12-9.module+el8.2.0+6368+cf16aa14
criu-debuginfo< 0:3.12-9.module+el8.2.0+6370+6fb6c8ca | < 0:3.12-9.module+el8.2.0+6369+1f4293b4 | < 0:3.12-9.module+el8.2.0+6368+cf16aa14
criu-debugsource< 0:3.12-9.module+el8.2.0+6370+6fb6c8ca | < 0:3.12-9.module+el8.2.0+6369+1f4293b4 | < 0:3.12-9.module+el8.2.0+6368+cf16aa14
dracut< 0:049-70.git20200228.el8
dracut-caps< 0:049-70.git20200228.el8
dracut-config-generic< 0:049-70.git20200228.el8
dracut-config-rescue< 0:049-70.git20200228.el8
dracut-debuginfo< 0:049-70.git20200228.el8
dracut-debugsource< 0:049-70.git20200228.el8
dracut-live< 0:049-70.git20200228.el8
dracut-network< 0:049-70.git20200228.el8
dracut-squash< 0:049-70.git20200228.el8
dracut-tools< 0:049-70.git20200228.el8
dumb-init< 0:1.1.3-12.el7
dumb-init-debuginfo< 0:1.1.3-12.el7
elastic-curator< 0:5.2.0-1.el7
faq< 0:0.0.6-4.el7
faq-debuginfo< 0:0.0.6-4.el7
fb303< 0:0.9.1-15.el7
fb303-devel< 0:0.9.1-15.el7
fb303-java< 0:0.9.1-15.el7
fuse-overlayfs< 0:0.3-5.module+el8.2.0+6370+6fb6c8ca | < 0:0.7.2-5.module+el8.2.0+6369+1f4293b4 | < 0:0.7.2-5.module+el8.2.0+6368+cf16aa14 | < 0:0.7.2-1.el7
fuse-overlayfs-debuginfo< 0:0.3-5.module+el8.2.0+6370+6fb6c8ca | < 0:0.7.2-5.module+el8.2.0+6369+1f4293b4 | < 0:0.7.2-5.module+el8.2.0+6368+cf16aa14 | < 0:0.7.2-1.el7
fuse-overlayfs-debugsource< 0:0.3-5.module+el8.2.0+6370+6fb6c8ca | < 0:0.7.2-5.module+el8.2.0+6369+1f4293b4 | < 0:0.7.2-5.module+el8.2.0+6368+cf16aa14
golang-github-prometheus-promu< 0:0.5.0-2.git642a960.el7
golang-scl-shim< 0:1.13.4-1.el7
gperftools< 0:2.6.3-2.el8+7
gperftools-debugsource< 0:2.6.3-2.el8+7
gperftools-devel< 0:2.6.3-2.el8+7
gperftools-libs< 0:2.6.3-2.el8+7
gperftools-libs-debuginfo< 0:2.6.3-2.el8+7
grpc< 0:1.18.0-4.el8ost
grpc-cli< 0:1.18.0-4.el8ost
grpc-cli-debuginfo< 0:1.18.0-4.el8ost
grpc-debuginfo< 0:1.18.0-4.el8ost
grpc-debugsource< 0:1.18.0-4.el8ost
grpc-devel< 0:1.18.0-4.el8ost
grpc-plugins< 0:1.18.0-4.el8ost
grpc-plugins-debuginfo< 0:1.18.0-4.el8ost
ignition< 0:0.35.0-5.rhaos4.4.git7afbeba.el8
ignition-debuginfo< 0:0.35.0-5.rhaos4.4.git7afbeba.el8
ignition-debugsource< 0:0.35.0-5.rhaos4.4.git7afbeba.el8
ignition-validate< 0:0.35.0-5.rhaos4.4.git7afbeba.el8
ignition-validate-debuginfo< 0:0.35.0-5.rhaos4.4.git7afbeba.el8
inotify-tools< 0:3.20.1-2.el7
inotify-tools-debuginfo< 0:3.20.1-2.el7
inotify-tools-devel< 0:3.20.1-2.el7
iptables< 0:1.8.4-10.el8
iptables-arptables< 0:1.8.4-10.el8
iptables-debuginfo< 0:1.8.4-10.el8
iptables-debugsource< 0:1.8.4-10.el8
iptables-devel< 0:1.8.4-10.el8
iptables-ebtables< 0:1.8.4-10.el8
iptables-libs< 0:1.8.4-10.el8
iptables-libs-debuginfo< 0:1.8.4-10.el8
iptables-services< 0:1.8.4-10.el8
iptables-utils< 0:1.8.4-10.el8
iptables-utils-debuginfo< 0:1.8.4-10.el8
ipxe< 0:20181214-5.git133f4c47.el8
ipxe-bootimgs< 0:20181214-5.git133f4c47.el8
ipxe-rhcert< 0:20181214-5.git133f4c47.el8
ipxe-roms< 0:20181214-5.git133f4c47.el8
ipxe-roms-qemu< 0:20181214-5.git133f4c47.el8
jenkins< 0:2.204.2.1580893337-1.el7
jenkins-2-plugins< 0:4.4.1583444859-1.el7
jq< 0:1.6-2.el7
jq-debuginfo< 0:1.6-2.el7
jq-devel< 0:1.6-2.el7
kibana< 0:5.6.16-2.el7
kibana-debuginfo< 0:5.6.16-2.el7
kuryr-binding-scripts< 0:1.1.1-0.20190923160834.41e6964.el8ost
libnftnl< 0:1.1.5-4.el8
libnftnl-debuginfo< 0:1.1.5-4.el8
libnftnl-debugsource< 0:1.1.5-4.el8
libnftnl-devel< 0:1.1.5-4.el8
libthrift-java< 0:0.9.1-15.el7
libthrift-javadoc< 0:0.9.1-15.el7
libunwind< 0:1.2.1-5.el8
libunwind-debuginfo< 0:1.2.1-5.el8
libunwind-debugsource< 0:1.2.1-5.el8
libunwind-devel< 0:1.2.1-5.el8
machine-config-daemon< 0:4.4.0-202004260322.git.1.c95b750.el8
mariadb-apb-role< 0:1.3.7-1.el7
mysql-apb-role< 0:1.3.6-1.el7
nss-altfiles< 0:2.18.1-12.rhaos4.2.el8
nss-altfiles-debuginfo< 0:2.18.1-12.rhaos4.2.el8
nss-altfiles-debugsource< 0:2.18.1-12.rhaos4.2.el8
oci-systemd-hook< 1:0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca
oci-systemd-hook-debuginfo< 1:0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca
oci-systemd-hook-debugsource< 1:0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca
oci-umount< 2:2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca
oci-umount-debuginfo< 2:2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca
oci-umount-debugsource< 2:2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca
oniguruma< 0:5.9.2-5.el7
oniguruma-debuginfo< 0:5.9.2-5.el7
oniguruma-devel< 0:5.9.2-5.el7
openshift< 0:4.4.0-202004250654.git.1.ec72d7a.el7 | < 0:4.4.0-202004250654.git.1.ec72d7a.el8
openshift-ansible< 0:4.4.0-202004250654.git.1.b7a3cf7.el7
openshift-ansible-test< 0:4.4.0-202004250654.git.1.b7a3cf7.el7
openshift-clients< 0:4.4.0-202004250654.git.1.1b18194.el7 | < 0:4.4.0-202004250654.git.1.1b18194.el8
openshift-clients-redistributable< 0:4.4.0-202004250654.git.1.1b18194.el7 | < 0:4.4.0-202004250654.git.1.1b18194.el8
openshift-eventrouter< 0:0.2-4.git7c289cc.el7
openshift-eventrouter-debuginfo< 0:0.2-4.git7c289cc.el7
openshift-hyperkube< 0:4.4.0-202004250654.git.1.ec72d7a.el7 | < 0:4.4.0-202004250654.git.1.ec72d7a.el8
openshift-kuryr< 0:4.4.0-201911081316.git.1.05e7ac1.el7 | < 0:4.4.0-202004260017.git.1.42937a1.el8
openshift-kuryr-cni< 0:4.4.0-201911081316.git.1.05e7ac1.el7 | < 0:4.4.0-202004260017.git.1.42937a1.el8
openshift-kuryr-common< 0:4.4.0-201911081316.git.1.05e7ac1.el7 | < 0:4.4.0-202004260017.git.1.42937a1.el8
openshift-kuryr-controller< 0:4.4.0-201911081316.git.1.05e7ac1.el7 | < 0:4.4.0-202004260017.git.1.42937a1.el8
openstack-ironic< 1:13.0.3-0.20191217040142.3e39d7b.el8ost
openstack-ironic-api< 1:13.0.3-0.20191217040142.3e39d7b.el8ost
openstack-ironic-common< 1:13.0.3-0.20191217040142.3e39d7b.el8ost
openstack-ironic-conductor< 1:13.0.3-0.20191217040142.3e39d7b.el8ost
openstack-ironic-inspector< 0:9.2.1-0.20200124141914.578ab43.el8ost
openstack-ironic-inspector-api< 0:9.2.1-0.20200124141914.578ab43.el8ost
openstack-ironic-inspector-conductor< 0:9.2.1-0.20200124141914.578ab43.el8ost
openstack-ironic-inspector-dnsmasq< 0:9.2.1-0.20200124141914.578ab43.el8ost
openstack-ironic-python-agent< 0:5.0.1-0.20200123140814.025b790.el8ost
ostree< 0:2019.6-2.el8
ostree-debuginfo< 0:2019.6-2.el8
ostree-debugsource< 0:2019.6-2.el8
ostree-devel< 0:2019.6-2.el8
ostree-grub2< 0:2019.6-2.el8
ostree-libs< 0:2019.6-2.el8
ostree-libs-debuginfo< 0:2019.6-2.el8
ovn2.12< 0:2.12.0-32.el7fdn
ovn2.12-central< 0:2.12.0-32.el7fdn
ovn2.12-debuginfo< 0:2.12.0-32.el7fdn
ovn2.12-host< 0:2.12.0-32.el7fdn
ovn2.12-vtep< 0:2.12.0-32.el7fdn
perl-thrift< 0:0.9.1-15.el7
pivot< 0:0.0.5-2.rhaos4.2.el8
podman< 0:1.4.2-6.rhaos4.2.el8 | < 0:1.0.2-4.dev.git96ccc2e.rhaos4.1.el8 | < 0:1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca | < 0:1.6.4-11.module+el8.2.0+6369+1f4293b4 | < 0:1.6.4-11.module+el8.2.0+6368+cf16aa14 | < 0:1.6.4-12.rhaos4.4.el8
podman-debuginfo< 0:1.4.2-6.rhaos4.2.el8 | < 0:1.0.2-4.dev.git96ccc2e.rhaos4.1.el8 | < 0:1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca | < 0:1.6.4-11.module+el8.2.0+6369+1f4293b4 | < 0:1.6.4-11.module+el8.2.0+6368+cf16aa14 | < 0:1.6.4-12.rhaos4.4.el8
podman-debugsource< 0:1.4.2-6.rhaos4.2.el8 | < 0:1.0.2-4.dev.git96ccc2e.rhaos4.1.el8 | < 0:1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca | < 0:1.6.4-11.module+el8.2.0+6369+1f4293b4 | < 0:1.6.4-11.module+el8.2.0+6368+cf16aa14 | < 0:1.6.4-12.rhaos4.4.el8
podman-docker< 0:1.4.2-6.rhaos4.2.el8 | < 0:1.0.2-4.dev.git96ccc2e.rhaos4.1.el8 | < 0:1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca | < 0:1.6.4-11.module+el8.2.0+6369+1f4293b4 | < 0:1.6.4-11.module+el8.2.0+6368+cf16aa14 | < 0:1.6.4-12.rhaos4.4.el8
podman-manpages< 0:1.4.2-6.rhaos4.2.el8 | < 0:1.6.4-12.rhaos4.4.el8
podman-remote< 0:1.6.4-11.module+el8.2.0+6369+1f4293b4 | < 0:1.6.4-11.module+el8.2.0+6368+cf16aa14 | < 0:1.6.4-12.rhaos4.4.el8
podman-remote-debuginfo< 0:1.4.2-6.rhaos4.2.el8 | < 0:1.6.4-11.module+el8.2.0+6369+1f4293b4 | < 0:1.6.4-11.module+el8.2.0+6368+cf16aa14 | < 0:1.6.4-12.rhaos4.4.el8
podman-tests< 0:1.6.4-11.module+el8.2.0+6369+1f4293b4 | < 0:1.6.4-11.module+el8.2.0+6368+cf16aa14 | < 0:1.6.4-12.rhaos4.4.el8
postgresql-apb-role< 0:1.3.8-1.el7
pprof< 0:2.6.3-2.el8+7
prometheus-promu< 0:0.5.0-2.git642a960.el7
protobuf< 0:3.6.1-4.el8ost
protobuf-compiler< 0:3.6.1-4.el8ost
protobuf-compiler-debuginfo< 0:3.6.1-4.el8ost
protobuf-debuginfo< 0:3.6.1-4.el8ost
protobuf-debugsource< 0:3.6.1-4.el8ost
protobuf-devel< 0:3.6.1-4.el8ost
protobuf-lite< 0:3.6.1-4.el8ost
protobuf-lite-debuginfo< 0:3.6.1-4.el8ost
protobuf-lite-devel< 0:3.6.1-4.el8ost
protobuf-lite-static< 0:3.6.1-4.el8ost
protobuf-static< 0:3.6.1-4.el8ost
protobuf-vim< 0:3.6.1-4.el8ost
python-boto3< 0:1.4.0-1.el7
python-botocore< 0:1.4.57-5.el7
python-cachetools< 0:1.0.3-1.el7

Show all 193

Alpine1 product

buildah< 1.14.4-r0

Buildah_project1 product

buildah< 1.14.5

Chainguard1 product

buildahAll versions (No fix recorded)

Debian1 product

golang-github-containers-buildah< 1.11.6-2

Github.com/containers1 product

buildah< 1.14.4

Red hat1 product

buildahFixed in buildah-1.14.5

Wolfi1 product

buildahAll versions (No fix recorded)

8 vendors · 200 products · Showing 200 of 321

References

30 links

bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10696X Refsource CONFIRMFIXWEBExploitIssue TrackingPatchThird Party Advisory
github.com/containers/buildah/pull/2245X Refsource MISCEVIDENCEWEBFIXExploitThird Party Advisory
access.redhat.com/security/cve/cve-2020-10696X Refsource MISCAdvisoryWEBThird Party Advisory
access.redhat.com/errata/RHBA-2020:0582Advisory
bugzilla.redhat.com/show_bug.cgi?id=1767877REPORT
security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_0582.jsonAdvisory
access.redhat.com/security/cve/CVE-2020-10696REPORT
bugzilla.redhat.com/show_bug.cgi?id=1817651REPORTWEB
www.cve.org/CVERecord?id=CVE-2020-10696Advisory
nvd.nist.gov/vuln/detail/CVE-2020-10696Advisory

Show all 30 references