Executive brief
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah
Affected products
- Go github.com/containers/buildah
Junglewise Threat Intelligence
CVE-2024-11218: GO-2025-3414 - Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah
CVE-2024-11218 · Severity: low · CVSS 3.1 · Published 2025-01-28
Technologies: github.com/containers/buildah (Go). Vendors: Go.
Related threats
- Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not secur
- GO-2024-3169 - Improper Input Validation in Buildah and Podman in github.com/containers/buildah
- containers Buildah path traversal in cache mounts
- GO-2022-0828 - Path Traversal in Buildah in github.com/containers/buildah
- GO-2024-2658 - Container escape at build time in github.com/containers/buildah