Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
podman-container-tools/buildah
main @ 3695d9e
33
Fixes
6
CVEs
CRITICAL
Peak severity
44.8%
Coverage
Highlights
Path Traversal: 10 prior fixes. Scrutinize any change in this area.
imagebuildah: most-fixed (5 issues). Treat as high-risk during review.
14 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Unsafe resolution of build context paths using direct filepath joins instead of evaluated copier abstractions allowed host filesystem directories to be mounted directly inside container builds, leading to container escape. This is a critical risk when resolving dynamic paths under mount configurations.
Path Traversal: Insecure cache ID validation and cache mount source resolution permitted attackers to perform path traversal and access unauthorized directories outside the designated cache directories.
Arbitrary Code Execution: A vulnerability in namespace entry allowed container processes to overwrite the host buildah binary during execution (associated with CVE-2019-5736). The defense requires executing host-side binary tasks exclusively from a sealed, memory-backed anonymous file descriptor.