---
id: CVE-2021-3602
aliases:
  - GHSA-7638-r9r3-rmjj
  - GO-2022-0345
title: >-
  Buildah processes using chroot isolation may leak environment values to
  intermediate processes
summary: >-
  Buildah processes using chroot isolation may leak environment values to
  intermediate processes
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
vendor: containers
product: github.com/containers/buildah
ecosystem: go
affected:
  - github.com/containers/buildah < 1.16.8
  - 'github.com/containers/buildah >= 1.17.0, < 1.17.2'
  - 'github.com/containers/buildah >= 1.18.0, < 1.19.9'
  - 'github.com/containers/buildah >= 1.20.0, < 1.21.3'
patched:
  - github.com/containers/buildah 1.16.8
  - github.com/containers/buildah 1.17.2
  - github.com/containers/buildah 1.19.9
  - github.com/containers/buildah 1.21.3
published: '2021-07-19'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:06.380243521Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-7638-r9r3-rmjj'
references:
  - url: >-
      https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjj
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-3602'
  - url: >-
      https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1969264'
  - url: 'https://github.com/containers/buildah'
  - url: 'https://pkg.go.dev/vuln/GO-2022-0345'
  - url: 'https://ubuntu.com/security/CVE-2021-3602'
tags:
  - osv
  - go
epss: 0.00327
epssPercentile: 0.26023
ingestedAt: '2026-07-09T18:56:36.189Z'
---

## Overview

### Impact
When running processes using "chroot" isolation, the process being run can examine the environment variables of its immediate parent and grandparent processes (CVE-2021-3602).  This isolation type is often used when running `buildah` in unprivileged containers, and it is often used to do so in CI/CD environments.  If sensitive information is exposed to the original `buildah` process through its environment, that information will unintentionally be shared with child processes which it starts as part of handling RUN instructions or during `buildah run`.  The commands that `buildah` is instructed to run can read that information if they choose to.

### Patches
Users should upgrade packages, or images which contain packages, to include version 1.21.3 or later.

### Workarounds
As a workaround, invoking `buildah` in a container under `env -i` to have it started with a reinitialized environment should prevent the leakage.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [buildah](https://github.com/containers/buildah/issues)
* Email us at [the buildah general mailing list](mailto:buildah@lists.buildah.io), or [the podman security mailing list](mailto:security@lists.podman.io) if it's sensitive.

## Affected packages

- `github.com/containers/buildah < 1.16.8`
- `github.com/containers/buildah >= 1.17.0, < 1.17.2`
- `github.com/containers/buildah >= 1.18.0, < 1.19.9`
- `github.com/containers/buildah >= 1.20.0, < 1.21.3`

## Remediation

Upgrade to a patched release:

- `github.com/containers/buildah 1.16.8`
- `github.com/containers/buildah 1.17.2`
- `github.com/containers/buildah 1.19.9`
- `github.com/containers/buildah 1.21.3`