Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.4:Update
podman.33052
0001-buildah-CVE-2024-1753-container-escape-fix...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0001-buildah-CVE-2024-1753-container-escape-fix.patch of Package podman.33052
From 070dcd6ed8ad816aaaa99d391fe907ef0a1200d8 Mon Sep 17 00:00:00 2001 From: Tom Sweeney <tsweeney@redhat.com> Date: Tue, 19 Mar 2024 14:30:27 +0100 Subject: [PATCH] [buildah] CVE-2024-1753 container escape fix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses CVE-2024-1753 which allowed a user to write files to the `/` directory of the host machine if selinux was not enabled. Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com> Signed-off-by: Dan Čermák <dcermak@suse.com> --- .../github.com/containers/buildah/internal/parse/parse.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/vendor/github.com/containers/buildah/internal/parse/parse.go b/vendor/github.com/containers/buildah/internal/parse/parse.go index 5050be38b..a5121af2c 100644 --- a/vendor/github.com/containers/buildah/internal/parse/parse.go +++ b/vendor/github.com/containers/buildah/internal/parse/parse.go @@ -11,6 +11,7 @@ import ( "errors" + "github.com/containers/buildah/copier" "github.com/containers/buildah/define" "github.com/containers/buildah/internal" internalUtil "github.com/containers/buildah/internal/util" @@ -164,7 +165,11 @@ func GetBindMount(ctx *types.SystemContext, args []string, contextDir string, st // buildkit parity: support absolute path for sources from current build context if contextDir != "" { // path should be /contextDir/specified path - newMount.Source = filepath.Join(contextDir, filepath.Clean(string(filepath.Separator)+newMount.Source)) + evaluated, err := copier.Eval(contextDir, newMount.Source, copier.EvalOptions{}) + if err != nil { + return newMount, "", err + } + newMount.Source = evaluated } else { // looks like its coming from `build run --mount=type=bind` allow using absolute path // error out if no source is set -- 2.44.0
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor