CVE-2020-10696

Name of the Vulnerable Software and Affected Versions Buildah versions prior to 1.14.5

Description A path traversal flaw was found in Buildah. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions. The issue exists due to incorrect restriction of the path name to a directory with limited access, which can be exploited by a remote attacker to create a malicious container image and replace arbitrary files in the user's system.

Recommendations For versions prior to 1.14.5, update to version 1.14.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of Buildah to minimize the risk of exploitation. Avoid using Buildah to build container images from untrusted sources until the issue is resolved.