CVE:CVE-2020-10696
CNNVD:CNNVD-202003-1646
Buildah是一款支持构建OCI容器映像的工具。
Buildah 1.14.5之前版本中存在路径遍历漏洞。攻击者可借助特制URL利用该漏洞将文件写入到用户系统中用户权限所允许的位置。
solution:Upgrade buildah_project buildah to a higher version than 1.14.5,and avoid the version (,1.14.5); Upgrade redhat openshift_container_platform to a higher version than 3.11,and avoid the version 3.11; Upgrade redhat enterprise_linux to a higher version than 7.0,8.0,and avoid the version 7.0,8.0