Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat buildah: Unauthorized access to build container images

published 7 months ago

Summary

A security update is available for buildah, a tool for building and working with container images. This update fixes a vulnerability that could allow an attacker to gain unauthorized access to build container images, potentially leading to data exposure or malicious code execution. To protect your systems, install the latest version of buildah using your package manager.

What to do

Update redhat buildah to version 1:1.29.5-1.el9_2.2.
Update redhat buildah-debuginfo to version 1:1.29.5-1.el9_2.2.
Update redhat buildah-debugsource to version 1:1.29.5-1.el9_2.2.
Update redhat buildah-tests to version 1:1.29.5-1.el9_2.2.
Update redhat buildah-tests-debuginfo to version 1:1.29.5-1.el9_2.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:9.2::appstream	redhat	buildah	< 1:1.29.5-1.el9_2.2 Fix: upgrade to 1:1.29.5-1.el9_2.2
Red Hat:rhel_e4s:9.2::appstream	redhat	buildah-debuginfo	< 1:1.29.5-1.el9_2.2 Fix: upgrade to 1:1.29.5-1.el9_2.2
Red Hat:rhel_e4s:9.2::appstream	redhat	buildah-debugsource	< 1:1.29.5-1.el9_2.2 Fix: upgrade to 1:1.29.5-1.el9_2.2
Red Hat:rhel_e4s:9.2::appstream	redhat	buildah-tests	< 1:1.29.5-1.el9_2.2 Fix: upgrade to 1:1.29.5-1.el9_2.2
Red Hat:rhel_e4s:9.2::appstream	redhat	buildah-tests-debuginfo	< 1:1.29.5-1.el9_2.2 Fix: upgrade to 1:1.29.5-1.el9_2.2

Original advisory text

Red Hat Security Advisory: buildah security update

References

https://access.redhat.com/errata/RHSA-2026:4532 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2404715 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2407258 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2414943 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2418900 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4532.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-47913 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-47913 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-47913 Vendor Advisory
https://github.com/advisories/GHSA-hcg3-q754-cr77 Vendor Advisory
https://go.dev/cl/700295 Third Party Advisory
https://go.dev/issue/75178 Third Party Advisory
https://pkg.go.dev/vuln/GO-2025-4116 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-52881 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-52881 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-52881 Vendor Advisory
https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm Third Party Advisory
https://github.com/opencontainers/selinux/pull/237 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2025-58183 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-58183 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-58183 Vendor Advisory
https://go.dev/cl/709861 Third Party Advisory
https://go.dev/issue/75677 Third Party Advisory
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI Third Party Advisory
https://pkg.go.dev/vuln/GO-2025-4014 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-65637 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-65637 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-65637 Vendor Advisory
https://github.com/mjuanxd/logrus-dos-poc Third Party Advisory
https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md Third Party Advisory
https://github.com/sirupsen/logrus/issues/1370 Third Party Advisory
https://github.com/sirupsen/logrus/pull/1376 Third Party Advisory
https://github.com/sirupsen/logrus/releases/tag/v1.8.3 Third Party Advisory
https://github.com/sirupsen/logrus/releases/tag/v1.9.1 Third Party Advisory
https://github.com/sirupsen/logrus/releases/tag/v1.9.3 Third Party Advisory
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.2 High

Timeline

Published13 Mar 2026

Updated15 Mar 2026

First seen15 Mar 2026

Sources

RHSA-2026:4532 · OSV

Track software like this

Free during beta