{"cve":"CVE-2021-3602","nvd":{"published":"2022-03-03T19:15:08.107","modified":"2026-06-17T04:05:25.127","status":"Modified","description":"An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.5},"cwes":["CWE-212","CWE-200"],"references":["https://bugzilla.redhat.com/show_bug.cgi?id=1969264","https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0","https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjj","https://ubuntu.com/security/CVE-2021-3602","https://bugzilla.redhat.com/show_bug.cgi?id=1969264"],"products":["buildah_project:buildah","redhat:enterprise_linux","redhat:enterprise_linux_for_ibm_z_systems","redhat:enterprise_linux_for_power_little_endian"],"source":"nvd","synced_at":"2026-10-19T21:28:04.509275555+00:00"},"epss":{"cve":"CVE-2021-3602","score":0.00327,"percentile":0.25799,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-7638-r9r3-rmjj","url":"https://osv.dev/vulnerability/GHSA-7638-r9r3-rmjj","summary":"Buildah processes using chroot isolation may leak environment values to intermediate processes","modified":"2026-09-10T03:49:06.380243521Z","packages":[{"ecosystem":"Go","name":"github.com/containers/buildah","purl":"pkg:golang/github.com/containers/buildah","ranges":["<1.16.8"],"fixed":["1.16.8"]},{"ecosystem":"Go","name":"github.com/containers/buildah","purl":"pkg:golang/github.com/containers/buildah","ranges":[">=1.17.0 <1.17.2"],"fixed":["1.17.2"]},{"ecosystem":"Go","name":"github.com/containers/buildah","purl":"pkg:golang/github.com/containers/buildah","ranges":[">=1.18.0 <1.19.9"],"fixed":["1.19.9"]},{"ecosystem":"Go","name":"github.com/containers/buildah","purl":"pkg:golang/github.com/containers/buildah","ranges":[">=1.20.0 <1.21.3"],"fixed":["1.21.3"]}]},{"id":"GO-2022-0345","url":"https://osv.dev/vulnerability/GO-2022-0345","summary":"Environment variable leakage in github.com/containers/buildah","modified":"2026-02-04T03:52:10.147303Z","packages":[{"ecosystem":"Go","name":"github.com/containers/buildah","purl":"pkg:golang/github.com/containers/buildah","ranges":["<1.22.0"],"fixed":["1.22.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}