{"id":"CVE-2021-3602","aliases":["GHSA-7638-r9r3-rmjj","GO-2022-0345"],"title":"Buildah processes using chroot isolation may leak environment values to intermediate processes","summary":"Buildah processes using chroot isolation may leak environment values to intermediate processes","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendor":"containers","product":"github.com/containers/buildah","ecosystem":"go","affected":["github.com/containers/buildah < 1.16.8","github.com/containers/buildah >= 1.17.0, < 1.17.2","github.com/containers/buildah >= 1.18.0, < 1.19.9","github.com/containers/buildah >= 1.20.0, < 1.21.3"],"patched":["github.com/containers/buildah 1.16.8","github.com/containers/buildah 1.17.2","github.com/containers/buildah 1.19.9","github.com/containers/buildah 1.21.3"],"published":"2021-07-19","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:06.380243521Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-7638-r9r3-rmjj","references":[{"url":"https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjj"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3602"},{"url":"https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1969264"},{"url":"https://github.com/containers/buildah"},{"url":"https://pkg.go.dev/vuln/GO-2022-0345"},{"url":"https://ubuntu.com/security/CVE-2021-3602"}],"tags":["osv","go"],"epss":0.00327,"epssPercentile":0.2594,"ingestedAt":"2026-07-09T18:56:36.189Z","slug":"CVE-2021-3602","body":"## Overview\n\n### Impact\nWhen running processes using \"chroot\" isolation, the process being run can examine the environment variables of its immediate parent and grandparent processes (CVE-2021-3602).  This isolation type is often used when running `buildah` in unprivileged containers, and it is often used to do so in CI/CD environments.  If sensitive information is exposed to the original `buildah` process through its environment, that information will unintentionally be shared with child processes which it starts as part of handling RUN instructions or during `buildah run`.  The commands that `buildah` is instructed to run can read that information if they choose to.\n\n### Patches\nUsers should upgrade packages, or images which contain packages, to include version 1.21.3 or later.\n\n### Workarounds\nAs a workaround, invoking `buildah` in a container under `env -i` to have it started with a reinitialized environment should prevent the leakage.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [buildah](https://github.com/containers/buildah/issues)\n* Email us at [the buildah general mailing list](mailto:buildah@lists.buildah.io), or [the podman security mailing list](mailto:security@lists.podman.io) if it's sensitive.\n\n## Affected packages\n\n- `github.com/containers/buildah < 1.16.8`\n- `github.com/containers/buildah >= 1.17.0, < 1.17.2`\n- `github.com/containers/buildah >= 1.18.0, < 1.19.9`\n- `github.com/containers/buildah >= 1.20.0, < 1.21.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/containers/buildah 1.16.8`\n- `github.com/containers/buildah 1.17.2`\n- `github.com/containers/buildah 1.19.9`\n- `github.com/containers/buildah 1.21.3`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}