Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
Red Hat Buildah Vulnerability: Privilege Escalation Risk
published 1 year ago
Summary
A security flaw in Red Hat Buildah could allow an attacker to gain elevated privileges, potentially leading to unauthorized access to sensitive data or system modifications. This issue affects users of Red Hat Buildah, a tool for building and working with container images. To address this vulnerability, users are advised to apply the latest security update.
What to do
- Update redhat buildah to version 2:1.39.4-2.el10_0.
- Update redhat buildah-debuginfo to version 2:1.39.4-2.el10_0.
- Update redhat buildah-debugsource to version 2:1.39.4-2.el10_0.
- Update redhat buildah-tests to version 2:1.39.4-2.el10_0.
- Update redhat buildah-tests-debuginfo to version 2:1.39.4-2.el10_0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:10.0 | redhat | buildah |
< 2:1.39.4-2.el10_0 Fix: upgrade to 2:1.39.4-2.el10_0
|
| Red Hat:enterprise_linux:10.0 | redhat | buildah-debuginfo |
< 2:1.39.4-2.el10_0 Fix: upgrade to 2:1.39.4-2.el10_0
|
| Red Hat:enterprise_linux:10.0 | redhat | buildah-debugsource |
< 2:1.39.4-2.el10_0 Fix: upgrade to 2:1.39.4-2.el10_0
|
| Red Hat:enterprise_linux:10.0 | redhat | buildah-tests |
< 2:1.39.4-2.el10_0 Fix: upgrade to 2:1.39.4-2.el10_0
|
| Red Hat:enterprise_linux:10.0 | redhat | buildah-tests-debuginfo |
< 2:1.39.4-2.el10_0 Fix: upgrade to 2:1.39.4-2.el10_0
|
Original advisory text
Red Hat Security Advisory: buildah security update
References
- https://access.redhat.com/errata/RHSA-2025:9148 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2358493 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9148.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-22871 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-22871 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22871 Vendor Advisory
- https://go.dev/cl/652998 Third Party Advisory
- https://go.dev/issue/71988 Third Party Advisory
- https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk Third Party Advisory
- https://pkg.go.dev/vuln/GO-2025-3563 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published17 Jun 2025
Updated6 Mar 2026
First seen6 Mar 2026
Sources
RHSA-2025:9148 · OSV
Track software like this
Free during beta