buildah Project buildah
Approved changes feed: RSS · Atom
cpe:2.3:a:buildah_project:buildah:-:*:*:*:*:*:*:*part: a version: - update: *
| Vendor | Buildah Project (3609f222-43d6-551f-a3e2-8421dcd0de37) |
|---|---|
| Product | Buildah (66b72879-4ee7-5ff4-b9b7-d047e9a95dfc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/golang-github-containers-buildah |
purl2cpe | 2026-06-01 10:16:20.130327 |
pkg:deb/ubuntu/golang-github-containers-buildah |
purl2cpe | 2026-06-01 10:16:20.130331 |
pkg:github/containers/buildah |
purl2cpe | 2026-06-01 10:16:20.130334 |
pkg:gitlab/redhat/buildah |
purl2cpe | 2026-06-01 10:16:20.130337 |
pkg:rpm/centos/buildah |
purl2cpe | 2026-06-01 10:16:20.130340 |
pkg:rpm/fedora/buildah |
purl2cpe | 2026-06-01 10:16:20.130343 |
pkg:rpm/opensuse/buildah |
purl2cpe | 2026-06-01 10:16:20.130346 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-9675 |
vulnerable | 2026-06-08 07:00:28.456442 |
Buildah: buildah allows arbitrary directory mount
HIGH (7.8)
A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.
Published: 2024-10-09T14:32:11.922Z
Updated: 2026-11-04T21:28:01.667Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10214 |
vulnerable | 2026-06-08 05:12:22.533660 |
Details available
MEDIUM (6.4)
The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.
Published: 2019-11-25T10:41:15.000Z
Updated: 2024-08-04T22:17:18.901Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.