buildah.advisories.yaml

schema-version: 2.0.2

package:
  name: buildah

advisories:
  - id: CGA-2vj4-5vmv-c77c
    aliases:
      - CVE-2021-3602
      - GHSA-7638-r9r3-rmjj
    events:
      - timestamp: 2024-04-29T16:12:09Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 7b4e246fde7193c2
            componentName: github.com/containers/buildah
            componentVersion: v0.0.0-20240329173728-9f0251c1111d
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-08-01T20:41:52Z
        type: false-positive-determination
        data:
          type: component-vulnerability-mismatch
          note: The CVE was against an older version of the buildah module itself (< v1.16.8), and this package includes v1.36.0.

  - id: CGA-2x82-jh2m-c6cj
    aliases:
      - CVE-2020-10696
      - GHSA-fx8w-mjvm-hvpc
    events:
      - timestamp: 2024-04-29T16:12:13Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 7b4e246fde7193c2
            componentName: github.com/containers/buildah
            componentVersion: v0.0.0-20240329173728-9f0251c1111d
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-08-01T20:41:52Z
        type: false-positive-determination
        data:
          type: component-vulnerability-mismatch
          note: The CVE was against an older version of the buildah module itself (< v1.14.4), and this package includes v1.36.0.

  - id: CGA-4xwp-5773-9wcc
    aliases:
      - CVE-2025-67499
      - GHSA-jv3w-x3r3-g6rm
    events:
      - timestamp: 2025-12-10T11:04:40Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: a8dd539bce273b62
            componentName: github.com/containernetworking/plugins
            componentVersion: v1.8.0
            componentType: go-module
            componentLocation: /usr/bin/buildah
            scanner: grype
      - timestamp: 2025-12-10T13:19:49Z
        type: fixed
        data:
          fixed-version: 1.42.2-r2

  - id: CGA-5gv6-pp27-4cr3
    aliases:
      - CVE-2025-31133
      - GHSA-9493-h29p-rfm2
    events:
      - timestamp: 2025-11-07T08:03:55Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 2d377dba65f2bf64
            componentName: github.com/opencontainers/runc
            componentVersion: v1.3.2
            componentType: go-module
            componentLocation: /usr/bin/buildah
            scanner: grype
      - timestamp: 2025-11-08T07:04:51Z
        type: fixed
        data:
          fixed-version: 1.42.0-r1

  - id: CGA-693x-82vw-grgf
    aliases:
      - CVE-2024-11218
      - GHSA-5vpc-35f4-r8w6
    events:
      - timestamp: 2025-01-22T10:05:52Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 1d68476cd8203c4e
            componentName: github.com/containers/buildah
            componentVersion: v1.2.3
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2025-02-26T14:21:21Z
        type: fixed
        data:
          fixed-version: 1.39.0-r2

  - id: CGA-6q96-mpjg-2qg6
    aliases:
      - CVE-2024-3727
      - GHSA-6wvf-f2vw-3425
    events:
      - timestamp: 2024-05-22T07:35:35Z
        type: fixed
        data:
          fixed-version: 1.35.4-r0

  - id: CGA-7232-xmqv-f27r
    aliases:
      - CVE-2024-45310
      - GHSA-jfvp-7x6p-h2pv
    events:
      - timestamp: 2024-09-06T07:34:48Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: c87d85821fcc89c0
            componentName: github.com/opencontainers/runc
            componentVersion: v1.2.0-rc.1
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-09-06T10:16:39Z
        type: fixed
        data:
          fixed-version: 1.37.2-r1

  - id: CGA-7rhm-22mc-2p9c
    aliases:
      - CVE-2025-22869
    events:
      - timestamp: 2025-03-11T14:34:17Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: fb78ff74c5ccfc66
            componentName: golang.org/x/crypto
            componentVersion: v0.32.0
            componentType: go-module
            componentLocation: /usr/bin/buildah
            scanner: grype
      - timestamp: 2025-03-12T08:32:17Z
        type: fixed
        data:
          fixed-version: 1.39.2-r31

  - id: CGA-7vvx-h4j3-7gm5
    aliases:
      - CVE-2024-41110
      - GHSA-v23v-6jw2-98fq
    events:
      - timestamp: 2024-07-31T08:31:32Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: ddcf5cb2cb7200e4
            componentName: github.com/docker/docker
            componentVersion: v26.1.3+incompatible
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-08-01T21:18:35Z
        type: fixed
        data:
          fixed-version: 1.37.0-r0

  - id: CGA-88qm-3222-5w8j
    aliases:
      - CVE-2025-22870
      - GHSA-qxp5-gwg8-xv66
    events:
      - timestamp: 2025-03-14T07:07:58Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 0409990ef515b40b
            componentName: golang.org/x/net
            componentVersion: v0.34.0
            componentType: go-module
            componentLocation: /usr/bin/buildah
            scanner: grype
      - timestamp: 2025-03-16T00:42:39Z
        type: fixed
        data:
          fixed-version: 1.39.2-r32

  - id: CGA-92p5-wv75-xw3p
    aliases:
      - CVE-2025-27144
      - GHSA-c6gw-w398-hv78
    events:
      - timestamp: 2025-02-25T13:18:02Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 77876d923aaa1383
            componentName: github.com/go-jose/go-jose/v4
            componentVersion: v4.0.4
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2025-02-26T14:21:22Z
        type: fixed
        data:
          fixed-version: 1.39.0-r2

  - id: CGA-995x-7m99-76hh
    aliases:
      - CVE-2025-66506
      - GHSA-f83f-xpx7-ffpw
    events:
      - timestamp: 2025-12-06T11:05:16Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 0490ab01b2faf783
            componentName: github.com/sigstore/fulcio
            componentVersion: v1.7.1
            componentType: go-module
            componentLocation: /usr/bin/buildah
            scanner: grype
      - timestamp: 2025-12-07T16:34:34Z
        type: fixed
        data:
          fixed-version: 1.42.2-r1

  - id: CGA-cm27-9fv3-3gp8
    aliases:
      - CVE-2024-24789
      - GHSA-236w-p7wf-5ph8
    events:
      - timestamp: 2024-06-07T08:35:33Z
        type: fixed
        data:
          fixed-version: 1.36.0-r1

  - id: CGA-f9vx-65w8-xcmj
    aliases:
      - CVE-2025-52565
      - GHSA-qw9x-cqr3-wc7r
    events:
      - timestamp: 2025-11-07T08:03:57Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 2d377dba65f2bf64
            componentName: github.com/opencontainers/runc
            componentVersion: v1.3.2
            componentType: go-module
            componentLocation: /usr/bin/buildah
            scanner: grype
      - timestamp: 2025-11-08T07:04:51Z
        type: fixed
        data:
          fixed-version: 1.42.0-r1

  - id: CGA-gcv4-pvph-v9xr
    aliases:
      - CVE-2025-47914
      - GHSA-f6x5-jh6r-wrfv
    events:
      - timestamp: 2025-11-21T07:36:59Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 6195b5dbe23f5b8a
            componentName: golang.org/x/crypto
            componentVersion: v0.43.0
            componentType: go-module
            componentLocation: /usr/bin/buildah
            scanner: grype
      - timestamp: 2025-11-21T09:32:17Z
        type: fixed
        data:
          fixed-version: 1.42.1-r1

  - id: CGA-gpr2-42c3-43rf
    aliases:
      - CVE-2022-27651
      - GHSA-c3g4-w6cv-6v7h
    events:
      - timestamp: 2024-04-29T16:12:10Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 7b4e246fde7193c2
            componentName: github.com/containers/buildah
            componentVersion: v0.0.0-20240329173728-9f0251c1111d
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-08-01T20:41:52Z
        type: false-positive-determination
        data:
          type: component-vulnerability-mismatch
          note: The CVE was against an older version of the buildah module itself (< v1.25.0), and this package includes v1.36.0.

  - id: CGA-gwv5-f7q2-wrgj
    aliases:
      - CVE-2024-24791
      - GHSA-hw49-2p59-3mhj
    events:
      - timestamp: 2024-07-04T07:03:50Z
        type: fixed
        data:
          fixed-version: 1.36.0-r2

  - id: CGA-jf43-cp2x-wvrw
    aliases:
      - CVE-2024-3154
      - GHSA-2cgq-h8xw-2v5j
      - GHSA-c5pj-mqfh-rvc3
    events:
      - timestamp: 2024-04-29T16:12:11Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 3574ad06307e3c4c
            componentName: github.com/opencontainers/runc
            componentVersion: v1.1.12
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-04-30T10:01:18Z
        type: fixed
        data:
          fixed-version: 1.35.3-r1

  - id: CGA-m43w-332q-6hx9
    aliases:
      - CVE-2025-54388
      - GHSA-x4rx-4gw3-53p4
    events:
      - timestamp: 2025-07-30T07:28:14Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: e36bf6eded04873c
            componentName: github.com/docker/docker
            componentVersion: v28.3.2+incompatible
            componentType: go-module
            componentLocation: /usr/bin/buildah
            scanner: grype
      - timestamp: 2025-07-30T09:31:18Z
        type: fixed
        data:
          fixed-version: 1.41.0-r1

  - id: CGA-m6c7-44pr-g4mx
    aliases:
      - CVE-2025-58181
      - GHSA-j5w8-q4qc-rx2x
    events:
      - timestamp: 2025-11-21T07:36:59Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 6195b5dbe23f5b8a
            componentName: golang.org/x/crypto
            componentVersion: v0.43.0
            componentType: go-module
            componentLocation: /usr/bin/buildah
            scanner: grype
      - timestamp: 2025-11-21T09:32:18Z
        type: fixed
        data:
          fixed-version: 1.42.1-r1

  - id: CGA-p5jm-hq7x-fwc2
    aliases:
      - CVE-2024-9407
      - GHSA-fhqq-8f65-5xfc
    events:
      - timestamp: 2024-10-02T07:18:58Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: a882c4ba425417c6
            componentName: github.com/containers/buildah
            componentVersion: v1.2.3
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2025-02-26T14:21:22Z
        type: fixed
        data:
          fixed-version: 1.39.0-r2

  - id: CGA-p7mp-vc93-97fq
    aliases:
      - CVE-2024-9341
      - GHSA-mc76-5925-c5p6
    events:
      - timestamp: 2024-10-02T07:19:03Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 48abd9ac89413925
            componentName: github.com/containers/common
            componentVersion: v0.60.2
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-10-02T22:26:36Z
        type: fixed
        data:
          fixed-version: 1.37.3-r1

  - id: CGA-q242-97wx-vgx7
    aliases:
      - CVE-2025-22871
      - GHSA-g9pc-8g42-g6vq
    events:
      - timestamp: 2025-04-10T07:06:58Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 88c5d0971d79ead1
            componentName: stdlib
            componentVersion: go1.24.1
            componentType: go-module
            componentLocation: /usr/bin/buildah
            scanner: grype
      - timestamp: 2025-04-10T09:21:33Z
        type: fixed
        data:
          fixed-version: 1.39.4-r1

  - id: CGA-qpcg-j47v-7mxp
    aliases:
      - CVE-2024-45338
      - GHSA-w32m-9786-jp63
    events:
      - timestamp: 2024-12-19T07:42:12Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 7eb307fa7d0d555b
            componentName: golang.org/x/net
            componentVersion: v0.30.0
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-12-19T17:30:55Z
        type: fixed
        data:
          fixed-version: 1.38.0-r2

  - id: CGA-r57m-5pch-vr92
    aliases:
      - CVE-2024-34155
      - GHSA-8xfx-rj4p-23jm
    events:
      - timestamp: 2024-09-11T11:24:54Z
        type: fixed
        data:
          fixed-version: 1.37.2-r1

  - id: CGA-r5qm-42mj-wpp4
    aliases:
      - CVE-2024-34156
      - GHSA-crqm-pwhx-j97f
    events:
      - timestamp: 2024-09-11T11:24:58Z
        type: fixed
        data:
          fixed-version: 1.37.2-r1

  - id: CGA-rh3c-q4xm-7v9p
    aliases:
      - CVE-2024-9675
      - GHSA-586p-749j-fhwp
    events:
      - timestamp: 2024-10-10T08:23:04Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 2e2dc5901c7ff784
            componentName: github.com/containers/buildah
            componentVersion: v1.2.3
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2025-02-26T14:21:23Z
        type: fixed
        data:
          fixed-version: 1.39.0-r2

  - id: CGA-rm3g-prjv-vvq6
    aliases:
      - CVE-2024-45337
      - GHSA-v778-237x-gjrc
    events:
      - timestamp: 2024-12-12T07:02:54Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: c6c881d4b63fc6a0
            componentName: golang.org/x/crypto
            componentVersion: v0.29.0
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-12-13T08:01:19Z
        type: fixed
        data:
          fixed-version: 1.38.0-r1

  - id: CGA-v3xf-cq73-hg3j
    aliases:
      - CVE-2025-22872
      - GHSA-vvgc-356p-c3xw
    events:
      - timestamp: 2025-04-17T08:31:50Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 4dd7e63f70fd4b4a
            componentName: golang.org/x/net
            componentVersion: v0.36.0
            componentType: go-module
            componentLocation: /usr/bin/buildah
            scanner: grype
      - timestamp: 2025-04-18T05:22:01Z
        type: fixed
        data:
          fixed-version: 1.39.4-r2

  - id: CGA-v74r-cgr4-7ggw
    aliases:
      - CVE-2025-22866
      - GHSA-3whm-j4xm-rv8x
    events:
      - timestamp: 2025-02-08T22:03:50Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: c59ed1b08495bdf3
            componentName: stdlib
            componentVersion: go1.23.5
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2025-02-11T15:43:02Z
        type: fixed
        data:
          fixed-version: 1.39.0-r1

  - id: CGA-vw3g-r8hf-vg9p
    aliases:
      - CVE-2025-52881
      - GHSA-cgrx-mc8f-2prm
    events:
      - timestamp: 2025-11-07T08:03:56Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 2d377dba65f2bf64
            componentName: github.com/opencontainers/runc
            componentVersion: v1.3.2
            componentType: go-module
            componentLocation: /usr/bin/buildah
            scanner: grype
      - timestamp: 2025-11-13T11:47:53Z
        type: pending-upstream-fix
        data:
          note: This CVE impacts the dependency github.com/opencontainers/selinux, which needs to be updated to v1.13.0. However, v1.13.0 depends upon v0.6.0 of github.com/cyphar/filepath-securejoin, which has removed the previously deprecated functions OpenInRoot and Reopen. These functions are used by the latest version of another buildah dependency (go.podman.io/storage), so the selinux dependency cannot be updated until upstream code changes are made

  - id: CGA-w3x9-fj4v-fj48
    aliases:
      - CVE-2024-34158
      - GHSA-j7vj-rw65-4v26
    events:
      - timestamp: 2024-09-11T11:25:03Z
        type: fixed
        data:
          fixed-version: 1.37.2-r1

  - id: CGA-x59c-rc24-rqm2
    aliases:
      - CVE-2024-24790
      - GHSA-49gw-vxvf-fc2g
    events:
      - timestamp: 2024-06-07T08:35:35Z
        type: fixed
        data:
          fixed-version: 1.36.0-r1

  - id: CGA-x7mh-w3g6-2c7r
    aliases:
      - CVE-2022-2990
      - GHSA-fjm8-m7m6-2fjp
    events:
      - timestamp: 2024-04-29T16:12:12Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 7b4e246fde7193c2
            componentName: github.com/containers/buildah
            componentVersion: v0.0.0-20240329173728-9f0251c1111d
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-08-01T20:41:52Z
        type: false-positive-determination
        data:
          type: component-vulnerability-mismatch
          note: The CVE was against an older version of the buildah module itself (< v1.27.1), and this package includes v1.36.0.