CVE-2021-3602 — buildah: Host environment variables leaked in build container when using chroot isolation

Back Back to CVE browser

MEDIUM

buildah: Host environment variables leaked in build container when using chroot isolation

Published Mar 3, 2022

5.6

MEDIUM

CVSS 3.1

EPSS 0.33%

Description

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).

Affected products

Vendor n/a Product Buildah Default
n/a
- Version
  Affects v1.21.2, v1.20.0, v1.19.8, v1.18.0, v1.17.1, v1.16.7, Fixed in v1.21.3, v1.19.9, v1.17.2, v1.16.8, v1.22.0 and above.
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Buildah

n/a

Version	Status	Constraints
Affects v1.21.2, v1.20.0, v1.19.8, v1.18.0, v1.17.1, v1.16.7, Fixed in v1.21.3, v1.19.9, v1.17.2, v1.16.8, v1.22.0 and above.	affected	-

Red Hat Enterprise Linux 8

container-tools:2.0-8050020210817115648.faa19cc5

Fixed · RHSA-2021:4221
Red Hat Enterprise Linux 8

container-tools:3.0-8050020210915114620.faa19cc5

Fixed · RHSA-2021:4222
Red Hat Enterprise Linux 8

container-tools:rhel8-8050020210921082437.faa19cc5

Fixed · RHSA-2021:4154
Red Hat Enterprise Linux 7

buildah

Out of support scope
Red Hat Enterprise Linux 7

podman

Out of support scope
Red Hat Enterprise Linux 9

buildah

Not affected
Red Hat Enterprise Linux 9

podman

Not affected
Red Hat OpenShift Container Platform 3.11

podman

Will not fix
Red Hat OpenShift Container Platform 4

buildah

Will not fix
Red Hat OpenShift Container Platform 4

cri-o

Not affected
Red Hat OpenShift Container Platform 4

openshift4/ose-docker-builder

Not affected
Red Hat OpenShift Container Platform 4

podman

Will not fix
Red Hat Quay 3

quay/quay-builder-rhel8

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	container-tools:2.0-8050020210817115648.faa19cc5	Fixed	RHSA-2021:4221
Red Hat Enterprise Linux 8	container-tools:3.0-8050020210915114620.faa19cc5	Fixed	RHSA-2021:4222
Red Hat Enterprise Linux 8	container-tools:rhel8-8050020210921082437.faa19cc5	Fixed	RHSA-2021:4154
Red Hat Enterprise Linux 7	buildah	Out of support scope	n/a
Red Hat Enterprise Linux 7	podman	Out of support scope	n/a
Red Hat Enterprise Linux 9	buildah	Not affected	n/a
Red Hat Enterprise Linux 9	podman	Not affected	n/a
Red Hat OpenShift Container Platform 3.11	podman	Will not fix	n/a
Red Hat OpenShift Container Platform 4	buildah	Will not fix	n/a
Red Hat OpenShift Container Platform 4	cri-o	Not affected	n/a
Red Hat OpenShift Container Platform 4	openshift4/ose-docker-builder	Not affected	n/a
Red Hat OpenShift Container Platform 4	podman	Will not fix	n/a
Red Hat Quay 3	quay/quay-builder-rhel8	Will not fix	n/a

Ecosystem	Package	Introduced	Fixed
Go	github.com/containers/buildah	0	1.22.0

Remediation

Red Hat statement

OpenShift Container Platform 4's builder container is not vulnerable to this flaw as it uses OCI isolation (i.e. using runc) and does not use chroot isolation.

Metrics

0.33% 0.00327

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00327

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.33% (0.00327)	23.40th	v5 (v2026.06.15)
Jun 15, 2026	0.32% (0.00322)	23.68th	v5 (v2026.06.15)
Mar 17, 2025	0.03% (0.00031)	5.57th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00045)	17.70th	v3 (v2023.03.01)
Apr 30, 2024	0.04% (0.00045)	14.22th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00045)	12.21th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00950)	32.28th	v2 (v2022.01.01)
Sep 10, 2022	0.95% (0.00950)	30.63th	v2 (v2022.01.01)
Apr 1, 2022	0.95% (0.00950)	28.61th	v2 (v2022.01.01)
Mar 4, 2022	0.95% (0.00950)	14.24th	v2 (v2022.01.01)

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-212

References (9)

https://access.redhat.com/security/cve/CVE-2021-3602
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1969264
x_refsource_MISCIssue TrackingPatchThird Party Advisory
https://github.com/advisories/GHSA-7638-r9r3-rmjj
Advisory
https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0
x_refsource_MISCPatchThird Party Advisory
https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjj
x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3602
https://pkg.go.dev/vuln/GO-2022-0345
https://ubuntu.com/security/CVE-2021-3602
x_refsource_MISCPatchThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-3602

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2021-3602		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1969264		x_refsource_MISCIssue TrackingPatchThird Party Advisory
https://github.com/advisories/GHSA-7638-r9r3-rmjj		Advisory
https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0		x_refsource_MISCPatchThird Party Advisory
https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjj		x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3602
https://pkg.go.dev/vuln/GO-2022-0345
https://ubuntu.com/security/CVE-2021-3602		x_refsource_MISCPatchThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-3602