25 matches found
AWS-SAM-CLI-Vulnerabilities
AWS SAM CLI 漏洞（CVE-2025-3047 和 CVE-2025-3048） 本自述文件详细分析了 AWS Serverless Application Model CLI（AWS SAM CLI）中发现的两个安全漏洞——CVE-2025-3047 和 CVE-2025-3048，以及相关的代码级问题和修复。这两个漏洞都涉及在使用 Docker 容器进行构建过程中对符号链接的不正确处理。以下每一节涵盖一个 CVE，包括摘要、受影响代码（引用 SAM CLI 源代码）、补丁及其解决问题的方式，以及补救指南。 这些缺陷涉及 sam build --use-container...
CVE-2026-87055
A flaw was found in operator-sdk-builder. The software uses a flexible label, called a mutable tag, to identify its base container image instead of a unique, fixed identifier. This practice allows the underlying base image to change unexpectedly between builds. Such a change could introduce...
ROS-20260812-73-0012
The vulnerability of the BuildKit container-building software is related to an incorrect limitation on the path to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
github.com/moby/buildkit: BuildKit: Denial of Service via malicious client request
A flaw was found in BuildKit. A malicious BuildKit client or frontend can craft a specially designed request, leading to the BuildKit daemon crashing. This vulnerability results in a denial of service DoS, making the BuildKit service unavailable...
Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET SDK Microsoft.NET.Build.Containers. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A tampering...
AWS SAM CLI Path Traversal allows file copy to build container
SummaryThe AWS Serverless Application Model Command Line Interface AWS SAM CLI is an open-source CLI tool that helps Lambda developers to build and develop Lambda applications locally on their computers using Docker.When running the AWS SAM CLI build process with Docker and symlinks are included ...
CVE-2026-33744
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the docker.systempackages field in bentofile.yaml accepts arbitrary strings that are interpolated directly into Dockerfile RUN commands without sanitization. Since...
EUVD-2021-1126
Malware in sbrugna...
Podman Creates Temporary File with Insecure Permissions
A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files...
Security update for podman
This update for podman fixes the following issues: CVE-2023-45288: Fixed closing connection when receiving too many headers bsc1236507. CVE-2024-11218: Fixed container breakout by using --jobs=2 and a race condition when building a malicious Containerfile bsc1236270. CVE-2025-22869: Fixed Denial ...
Cachi2 安全漏洞
Cachi2 is an open source CLI tool from containerbuildsystem. A security vulnerability exists in Cachi2 versions prior to 0.14.0, which stems from the fact that the tool logs each function's local variables when an unhandled exception is triggered, potentially leading to the display of secret...
podman: Build Context Bind Mount
A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files...
Unbreakable Enterprise kernel-container security update
5.4.17-2136.336.5.1 - vhost/scsi: null-ptr-dereference in vhostscsigetreq Haoran Zhang Orabug: 37138988 5.4.17-2136.336.5 - uek-rpm: Add skxedaccommon.ko to nanomodules Sherry Yang Orabug: 37030127 - EDAC, i10nm: make skxcommon.o a separate module Arnd Bergmann Orabug: 37030127 - uek-rpm:...
Unbreakable Enterprise kernel security update
5.4.17-2136.336.5.1 - vhost/scsi: null-ptr-dereference in vhostscsigetreq Haoran Zhang Orabug: 37138988 5.4.17-2136.336.5 - uek-rpm: Add skxedaccommon.ko to nanomodules Sherry Yang Orabug: 37030127 - EDAC, i10nm: make skxcommon.o a separate module Arnd Bergmann Orabug: 37030127 - uek-rpm:...
GO-2022-1107 Container build can leak any path on the host into the container in github.com/docker/docker
Container build can leak any path on the host into the container in github.com/docker/docker...
An information disclosure flaw was found in Buildah when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
...
Container build can leak any path on the host into the container
Description Moby is the open source Linux container runtime and set of components used to build a variety of downstream container runtimes, including Docker CE, Mirantis Container Runtime formerly Docker EE, and Docker Desktop. Moby allows for building container images using a set of build...
Buildah 信息泄露漏洞
Buildah is a tool that supports building OCI container images. Buildah suffers from a security vulnerability that stems from the fact that processes running in a container build e.g., the Dockerfile RUN command have access to the environment variables of both the parent and grandfather processes...
Design/Logic Flaw
Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a different vulnerability than CVE-2020-25039...
