CVE-2021-3602: Environment variable leakage in github.com/containers/buildah
Summary
CVE-2021-3602: Environment variable leakage in github.com/containers/buildah. Affects github.com/containers/buildah versions < 1.22.0. Fixed in 1.22.0. How to fix ↓
Also tracked for
- golang-github-containers-buildah · Debian:11
The same CVE-2021-3602 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/containers/buildah package is a Go package that provides a set of command-line tools and libraries for building Open Container Initiative (OCI) images. It allows users to create, build, and modify container images without requiring a full container runtime. The package includes functionality for managing container builds, including the ability to run commands within a chroot environment. This vulnerability affects the RunUsingChroot function in the package, which unintentionally propagates environment variables from the current process to the child process.
Vulnerability Detail
The vulnerability (CVE-2021-3602) in github.com/containers/buildah allows environment variable leakage from the current process to the child process when using the RunUsingChroot function. This can lead to information disclosure if sensitive environment variables are exposed to unauthorized processes. An attacker who can execute arbitrary code within the chroot environment may be able to access these leaked environment variables and exploit them for malicious purposes. The vulnerability was fixed in version 1.22.0 of the package.
How To Fix
Latest published version: v1.43.5 as of 22 Oct 2026
go get github.com/containers/buildah@v1.43.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.22.0
This is the first release that contains the fix.
go get github.com/containers/buildah@v1.22.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the package as soon as possible.
Conclusion
The vulnerability (CVE-2021-3602) in github.com/containers/buildah allows environment variable leakage from the current process to the child process. It is recommended to update to version 1.22.0 or later of the package to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containers/buildah →
FAQ
github.com/containers/buildah is a Go package that provides tools and libraries for building OCI images without requiring a full container runtime.
The vulnerability allows environment variable leakage, which can lead to information disclosure if sensitive variables are exposed to unauthorized processes.
Update to version 1.22.0 or later of the github.com/containers/buildah package.
No, there is no known workaround. Updating to the fixed version is recommended.
You can find more information about this vulnerability in the CVE-2021-3602 entry or on the official GitHub repository for github.com/containers/buildah.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/buildah.
