CVE-2022-27651

Name	CVE-2022-27651
Description	A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1009882

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-github-containers-buildah (PTS)	bullseye	1.19.6+dfsg1-1	vulnerable
	bookworm	1.28.2+ds1-3	fixed
	sid, trixie	1.38.0+ds1-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang-github-containers-buildah	source	experimental	1.27.0+ds1-2
golang-github-containers-buildah	source	(unstable)	1.28.0+ds1-2			1009882

Notes

[bullseye] - golang-github-containers-buildah <no-dsa> (Minor issue)
https://github.com/containers/buildah/commit/e7e55c988c05dd74005184ceb64f097a0cfe645b (v1.25.1)
https://github.com/containers/buildah/security/advisories/GHSA-c3g4-w6cv-6v7h