VULNERABILITY INTELLIGENCE

CVE-2022-2990

CVSS score7.1 HIGH

EPSS probability0.35%

CISA KEVNot currently listed

Published2022-09-13

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

Weakness classification

secalert@redhat.com: CWE-842
nvd@nist.gov: CWE-863

Primary references

secalert@redhat.com — Exploit, Issue Tracking, Patch, Third Party Advisory
secalert@redhat.com — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory