CVE-2020-10696

A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.

A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.

A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.

Specific Go Packages Affected

github.com/containers/buildah/imagebuildah

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• conflicting requests: failed to install container-tools:1.0 (BZ#1813776)

• podman run container error with avc denied (BZ#1816541)

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• conflicting requests: failed to install container-tools:1.0 (BZ#1813776)

• podman run container error with avc denied (BZ#1816541)

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Path Traversal in Buildah in github.com/containers/buildah

This update for buildah fixes the following issues:

buildah was updated to v1.17.0 (bsc#1165184):

• Handle cases where other tools mount/unmount containers
• overlay.MountReadOnly: support RO overlay mounts
• overlay: use fusermount for rootless umounts
• overlay: fix umount
• Switch default log level of Buildah to Warn. Users need to see these messages
• Drop error messages about OCI/Docker format to Warning level
• build(deps): bump github.com/containers/common from 0.26.0 to 0.26.2
• tests/testreport: adjust for API break in storage v1.23.6
• build(deps): bump github.com/containers/storage from 1.23.5 to 1.23.7
• build(deps): bump github.com/fsouza/go-dockerclient from 1.6.5 to 1.6.6
• copier: put: ignore Typeflag='g'
• Use curl to get repo file (fix #2714)
• build(deps): bump github.com/containers/common from 0.25.0 to 0.26.0
• build(deps): bump github.com/spf13/cobra from 1.0.0 to 1.1.1
• Remove docs that refer to bors, since we're not using it
• Buildah bud should not use stdin by default
• bump containerd, docker, and golang.org/x/sys
• Makefile: cross: remove windows.386 target
• copier.copierHandlerPut: don't check length when there are errors
• Stop excessive wrapping
• CI: require that conformance tests pass
• bump(github.com/openshift/imagebuilder) to v1.1.8
• Skip tlsVerify insecure BUILD_REGISTRY_SOURCES
• Fix build path wrong containers/podman#7993
• refactor pullpolicy to avoid deps
• build(deps): bump github.com/containers/common from 0.24.0 to 0.25.0
• CI: run gating tasks with a lot more memory
• ADD and COPY: descend into excluded directories, sometimes
• copier: add more context to a couple of error messages
• copier: check an error earlier
• copier: log stderr output as debug on success
• Update nix pin with make nixpkgs
• Set directory ownership when copied with ID mapping
• build(deps): bump github.com/sirupsen/logrus from 1.6.0 to 1.7.0
• build(deps): bump github.com/containers/common from 0.23.0 to 0.24.0
• Cirrus: Remove bors artifacts
• Sort build flag definitions alphabetically
• ADD: only expand archives at the right time
• Remove configuration for bors
• Shell Completion for podman build flags
• Bump c/common to v0.24.0
• New CI check: xref --help vs man pages
• CI: re-enable several linters
• Move --userns-uid-map/--userns-gid-map description into buildah man page
• add: preserve ownerships and permissions on ADDed archives
• Makefile: tweak the cross-compile target
• Bump containers/common to v0.23.0
• chroot: create bind mount targets 0755 instead of 0700
• Change call to Split() to safer SplitN()
• chroot: fix handling of errno seccomp rules
• build(deps): bump github.com/containers/image/v5 from 5.5.2 to 5.6.0
• Add In Progress section to contributing
• integration tests: make sure tests run in ${topdir}/tests
• Run(): ignore containers.conf's environment configuration
• Warn when setting healthcheck in OCI format
• Cirrus: Skip git-validate on branches
• tools: update git-validation to the latest commit
• tools: update golangci-lint to v1.18.0
• Add a few tests of push command
• Add(): fix handling of relative paths with no ContextDir
• build(deps): bump github.com/containers/common from 0.21.0 to 0.22.0
• Lint: Use same linters as podman
• Validate: reference HEAD
• Fix buildah mount to display container names not ids
• Update nix pin with make nixpkgs
• Add missing --format option in buildah from man page
• Fix up code based on codespell
• build(deps): bump github.com/openshift/imagebuilder from 1.1.6 to 1.1.7
• build(deps): bump github.com/containers/storage from 1.23.4 to 1.23.5
• Improve buildah completions
• Cirrus: Fix validate commit epoch
• Fix bash completion of manifest flags
• Uniform some man pages
• Update Buildah Tutorial to address BZ1867426
• Update bash completion of manifest add sub command
• copier.Get(): hard link targets shouldn't be relative paths
• build(deps): bump github.com/onsi/gomega from 1.10.1 to 1.10.2
• Pass timestamp down to history lines
• Timestamp…

This update for buildah, libcontainers-common, podman fixes the following issues:

Changes in libcontainers-common:

• Update common to 0.33.0
• Update image to 5.9.0
• Update podman to 2.2.1
• Update storage to 1.24.5
• Switch to seccomp profile provided by common instead of podman
• Update containers.conf to match latest version

Changes in buildah:

Update to version 1.19.2:

• Update vendor of containers/storage and containers/common
• Buildah inspect should be able to inspect manifests
• Make buildah push support pushing manifests lists and digests
• Fix handling of TMPDIR environment variable
• Add support for --manifest flags
• Upper directory should match mode of destination directory
• Only grab the OS, Arch if the user actually specified them
• Use --arch and --os and --variant options to select architecture and os
• Cirrus: Track libseccomp and golang version
• copier.PutOptions: add an 'IgnoreDevices' flag
• fix: rmi --prune when parent image is in store.
• build(deps): bump github.com/containers/storage from 1.24.3 to 1.24.4
• build(deps): bump github.com/containers/common from 0.31.1 to 0.31.2
• Allow users to specify stdin into containers
• Drop log message on failure to mount on /sys file systems to info
• Spelling
• SELinux no longer requires a tag.
• build(deps): bump github.com/opencontainers/selinux from 1.6.0 to 1.8.0
• build(deps): bump github.com/containers/common from 0.31.0 to 0.31.1
• Update nix pin with make nixpkgs
• Switch references of /var/run -> /run
• Allow FROM to be overriden with from option
• copier: don't assume we can chroot() on Unixy systems
• copier: add PutOptions.NoOverwriteDirNonDir, Get/PutOptions.Rename
• copier: handle replacing directories with not-directories
• copier: Put: skip entries with zero-length names
• build(deps): bump github.com/containers/storage from 1.24.2 to 1.24.3
• Add U volume flag to chown source volumes
• Turn off PRIOR_UBUNTU Test until vm is updated
• pkg, cli: rootless uses correct isolation
• build(deps): bump github.com/onsi/gomega from 1.10.3 to 1.10.4
• update installation doc to reflect current status
• Move away from using docker.io
• enable short-name aliasing
• build(deps): bump github.com/containers/storage from 1.24.1 to 1.24.2
• build(deps): bump github.com/containers/common from 0.30.0 to 0.31.0
• Throw errors when using bogus --network flags
• pkg/supplemented test: replace our null blobinfocache
• build(deps): bump github.com/containers/common from 0.29.0 to 0.30.0
• inserts forgotten quotation mark
• Not prefer use local image create/add manifest
• Add container information to .containerenv
• Add --ignorefile flag to use alternate .dockerignore flags
• Add a source debug build
• Fix crash on invalid filter commands
• build(deps): bump github.com/containers/common from 0.27.0 to 0.29.0
• Switch to using containers/common pkg's
• fix: non-portable shebang #2812
• Remove copy/paste errors that leaked Podman into man pages.
• Add suggests cpp to spec file
• Apply suggestions from code review
• update docs for debian testing and unstable
• imagebuildah: disable pseudo-terminals for RUN
• Compute diffID for mapped-layer at creating image source
• intermediateImageExists: ignore images whose history we can't read
• Bump to v1.19.0-dev
• build(deps): bump github.com/containers/common from 0.26.3 to 0.27.0
• Fix testing error caused by simultanious merge
• Vendor in containers/storage v1.24.0
• short-names aliasing
• Add --policy flag to buildah pull
• Stop overwrapping and stuttering
• copier.Get(): ignore ENOTSUP/ENOSYS when listing xattrs
• Run: don't forcibly disable UTS namespaces in rootless mode
• test: ensure non-directory in a Dockerfile path is handled correctly
• Add a few tests for pull command
• Fix buildah config --cmd to handle array
• build(deps): bump github.com/containers/storage from 1.23.8 to 1.23.9
• Fix NPE when Dockerfile path contains non-directory entries
• Update buildah bud man page from podman build man page *…

This update for buildah fixes the following issues:

buildah was updated to version 1.23.1:

Update to version 1.22.3:

• Update dependencies
• Post-branch commit
• Accept repositories on login/logout

Update to version 1.22.0:

• c/image, c/storage, c/common vendor before Podman 3.3 release
• Proposed patch for 3399 (shadowutils)
• Fix handling of --restore shadow-utils
• runtime-flag (debug) test: handle old & new runc
• Allow dst and destination for target in secret mounts
• Multi-arch: Always push updated version-tagged img
• imagebuildah.stageExecutor.prepare(): remove pseudonym check
• refine dangling filter
• Chown with environment variables not set should fail
• Just restore protections of shadow-utils
• Remove specific kernel version number requirement from install.md
• Multi-arch image workflow: Make steps generic
• chroot: fix environment value leakage to intermediate processes
• Update nix pin with make nixpkgs
• buildah source - create and manage source images
• Update cirrus-cron notification GH workflow
• Reuse code from containers/common/pkg/parse
• Cirrus: Freshen VM images
• Fix excludes exception begining with / or ./
• Fix syntax for --manifest example
• vendor containers/common@main
• Cirrus: Drop dependence on fedora-minimal
• Adjust conformance-test error-message regex
• Workaround appearance of differing debug messages
• Cirrus: Install docker from package cache
• Switch rusagelogfile to use options.Out
• Turn stdio back to blocking when command finishes
• Add support for default network creation
• Cirrus: Updates for master->main rename
• Change references from master to main
• Add --env and --workingdir flags to run command
• [CI:DOCS] buildah bud: spelling --ignore-file requires parameter
• [CI:DOCS] push/pull: clarify supported transports
• Remove unused function arguments
• Create mountOptions for mount command flags
• Extract version command implementation to function
• Add --json flags to mount and version commands
• copier.Put(): set xattrs after ownership
• buildah add/copy: spelling
• buildah copy and buildah add should support .containerignore
• Remove unused util.StartsWithValidTransport
• Fix documentation of the --format option of buildah push
• Don't use alltransports.ParseImageName with known transports
• man pages: clarify rmi removes dangling parents
• [CI:DOCS] Fix links to c/image master branch
• imagebuildah: use the specified logger for logging preprocessing warnings
• Fix copy into workdir for a single file
• Fix docs links due to branch rename
• Update nix pin with make nixpkgs
• fix(docs): typo
• Move to v1.22.0-dev
• Fix handling of auth.json file while in a user namespace
• Add rusage-logfile flag to optionally send rusage to a file
• imagebuildah: redo step logging
• Add volumes to make running buildah within a container easier
• Add and use a 'copy' helper instead of podman load/save
• Bump github.com/containers/common from 0.38.4 to 0.39.0
• containerImageRef/containerImageSource: don't buffer uncompressed layers
• containerImageRef(): squashed images have no parent images
• Sync. workflow across skopeo, buildah, and podman
• Bump github.com/containers/storage from 1.31.1 to 1.31.2
• Bump github.com/opencontainers/runc from 1.0.0-rc94 to 1.0.0-rc95
• Bump to v1.21.1-dev [NO TESTS NEEDED]

These are all security issues fixed in the buildah-1.23.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the govulncheck-vulndb-0.0.20241213T205935-1.1 package on the GA media of openSUSE Tumbleweed.

This update for buildah fixes the following issues:

buildah was updated to v1.17.0 (bsc#1165184):

• Handle cases where other tools mount/unmount containers
• overlay.MountReadOnly: support RO overlay mounts
• overlay: use fusermount for rootless umounts
• overlay: fix umount
• Switch default log level of Buildah to Warn. Users need to see these messages
• Drop error messages about OCI/Docker format to Warning level
• build(deps): bump github.com/containers/common from 0.26.0 to 0.26.2
• tests/testreport: adjust for API break in storage v1.23.6
• build(deps): bump github.com/containers/storage from 1.23.5 to 1.23.7
• build(deps): bump github.com/fsouza/go-dockerclient from 1.6.5 to 1.6.6
• copier: put: ignore Typeflag='g'
• Use curl to get repo file (fix #2714)
• build(deps): bump github.com/containers/common from 0.25.0 to 0.26.0
• build(deps): bump github.com/spf13/cobra from 1.0.0 to 1.1.1
• Remove docs that refer to bors, since we're not using it
• Buildah bud should not use stdin by default
• bump containerd, docker, and golang.org/x/sys
• Makefile: cross: remove windows.386 target
• copier.copierHandlerPut: don't check length when there are errors
• Stop excessive wrapping
• CI: require that conformance tests pass
• bump(github.com/openshift/imagebuilder) to v1.1.8
• Skip tlsVerify insecure BUILD_REGISTRY_SOURCES
• Fix build path wrong containers/podman#7993
• refactor pullpolicy to avoid deps
• build(deps): bump github.com/containers/common from 0.24.0 to 0.25.0
• CI: run gating tasks with a lot more memory
• ADD and COPY: descend into excluded directories, sometimes
• copier: add more context to a couple of error messages
• copier: check an error earlier
• copier: log stderr output as debug on success
• Update nix pin with make nixpkgs
• Set directory ownership when copied with ID mapping
• build(deps): bump github.com/sirupsen/logrus from 1.6.0 to 1.7.0
• build(deps): bump github.com/containers/common from 0.23.0 to 0.24.0
• Cirrus: Remove bors artifacts
• Sort build flag definitions alphabetically
• ADD: only expand archives at the right time
• Remove configuration for bors
• Shell Completion for podman build flags
• Bump c/common to v0.24.0
• New CI check: xref --help vs man pages
• CI: re-enable several linters
• Move --userns-uid-map/--userns-gid-map description into buildah man page
• add: preserve ownerships and permissions on ADDed archives
• Makefile: tweak the cross-compile target
• Bump containers/common to v0.23.0
• chroot: create bind mount targets 0755 instead of 0700
• Change call to Split() to safer SplitN()
• chroot: fix handling of errno seccomp rules
• build(deps): bump github.com/containers/image/v5 from 5.5.2 to 5.6.0
• Add In Progress section to contributing
• integration tests: make sure tests run in ${topdir}/tests
• Run(): ignore containers.conf's environment configuration
• Warn when setting healthcheck in OCI format
• Cirrus: Skip git-validate on branches
• tools: update git-validation to the latest commit
• tools: update golangci-lint to v1.18.0
• Add a few tests of push command
• Add(): fix handling of relative paths with no ContextDir
• build(deps): bump github.com/containers/common from 0.21.0 to 0.22.0
• Lint: Use same linters as podman
• Validate: reference HEAD
• Fix buildah mount to display container names not ids
• Update nix pin with make nixpkgs
• Add missing --format option in buildah from man page
• Fix up code based on codespell
• build(deps): bump github.com/openshift/imagebuilder from 1.1.6 to 1.1.7
• build(deps): bump github.com/containers/storage from 1.23.4 to 1.23.5
• Improve buildah completions
• Cirrus: Fix validate commit epoch
• Fix bash completion of manifest flags
• Uniform some man pages
• Update Buildah Tutorial to address BZ1867426
• Update bash completion of manifest add sub command
• copier.Get(): hard link targets shouldn't be relative paths
• build(deps): bump github.com/onsi/gomega from 1.10.1 to 1.10.2
• Pass timestamp down to history lines
• Timestamp…

This update for buildah fixes the following issues:

buildah was updated to version 1.23.1:

Update to version 1.22.3:

• Update dependencies
• Post-branch commit
• Accept repositories on login/logout

Update to version 1.22.0:

• c/image, c/storage, c/common vendor before Podman 3.3 release
• Proposed patch for 3399 (shadowutils)
• Fix handling of --restore shadow-utils
• runtime-flag (debug) test: handle old & new runc
• Allow dst and destination for target in secret mounts
• Multi-arch: Always push updated version-tagged img
• imagebuildah.stageExecutor.prepare(): remove pseudonym check
• refine dangling filter
• Chown with environment variables not set should fail
• Just restore protections of shadow-utils
• Remove specific kernel version number requirement from install.md
• Multi-arch image workflow: Make steps generic
• chroot: fix environment value leakage to intermediate processes
• Update nix pin with make nixpkgs
• buildah source - create and manage source images
• Update cirrus-cron notification GH workflow
• Reuse code from containers/common/pkg/parse
• Cirrus: Freshen VM images
• Fix excludes exception begining with / or ./
• Fix syntax for --manifest example
• vendor containers/common@main
• Cirrus: Drop dependence on fedora-minimal
• Adjust conformance-test error-message regex
• Workaround appearance of differing debug messages
• Cirrus: Install docker from package cache
• Switch rusagelogfile to use options.Out
• Turn stdio back to blocking when command finishes
• Add support for default network creation
• Cirrus: Updates for master->main rename
• Change references from master to main
• Add --env and --workingdir flags to run command
• [CI:DOCS] buildah bud: spelling --ignore-file requires parameter
• [CI:DOCS] push/pull: clarify supported transports
• Remove unused function arguments
• Create mountOptions for mount command flags
• Extract version command implementation to function
• Add --json flags to mount and version commands
• copier.Put(): set xattrs after ownership
• buildah add/copy: spelling
• buildah copy and buildah add should support .containerignore
• Remove unused util.StartsWithValidTransport
• Fix documentation of the --format option of buildah push
• Don't use alltransports.ParseImageName with known transports
• man pages: clarify rmi removes dangling parents
• [CI:DOCS] Fix links to c/image master branch
• imagebuildah: use the specified logger for logging preprocessing warnings
• Fix copy into workdir for a single file
• Fix docs links due to branch rename
• Update nix pin with make nixpkgs
• fix(docs): typo
• Move to v1.22.0-dev
• Fix handling of auth.json file while in a user namespace
• Add rusage-logfile flag to optionally send rusage to a file
• imagebuildah: redo step logging
• Add volumes to make running buildah within a container easier
• Add and use a 'copy' helper instead of podman load/save
• Bump github.com/containers/common from 0.38.4 to 0.39.0
• containerImageRef/containerImageSource: don't buffer uncompressed layers
• containerImageRef(): squashed images have no parent images
• Sync. workflow across skopeo, buildah, and podman
• Bump github.com/containers/storage from 1.31.1 to 1.31.2
• Bump github.com/opencontainers/runc from 1.0.0-rc94 to 1.0.0-rc95
• Bump to v1.21.1-dev [NO TESTS NEEDED]

This update for buildah fixes the following issues:

• Updated to version 1.26.0:
  • CVE-2022-27651: Fixed an issue where containers were incorrectly started with non-empty inheritable Linux process capabilities (bsc#1197870).
  • CVE-2021-20206: Fixed an issue in libcni that could allow an attacker to execute arbitrary binaries on the host (bsc#1181961).
  • CVE-2020-10696: Fixed an issue that could lead to files being overwritten during the image building process (bsc#1167864).

This update for buildah fixes the following issues:

Buildah was updated to version 1.27.1:

• CVE-2021-20206: Fixed an issue in libcni that could allow an attacker to execute arbitrary binaries on the host (bsc#1181961).
• CVE-2020-10696: Fixed an issue that could lead to files being overwritten during the image building process (bsc#1167864).
• CVE-2022-2990: Fixed a possible information disclosure and modification (bsc#1202812).

This update for buildah fixes the following issues:

• CVE-2021-20206: Fixed an issue in libcni that could allow an attacker to execute arbitrary binaries on the host (bsc#1181961).
• CVE-2020-10696: Fixed an issue that could lead to files being overwritten during the image building process (bsc#1167864).
• CVE-2022-2990: Fixed possible information disclosure and modification / bsc#1202812

Buildah was updated to version 1.27.1:

• run: add container gid to additional groups

• Add fix for CVE-2022-2990 / bsc#1202812

Update to version 1.27.0:

• Don't try to call runLabelStdioPipes if spec.Linux is not set
• build: support filtering cache by duration using --cache-ttl
• build: support building from commit when using git repo as build context
• build: clean up git repos correctly when using subdirs
• integration tests: quote '?' in shell scripts
• test: manifest inspect should have OCIv1 annotation
• vendor: bump to c/common@87fab4b7019a
• Failure to determine a file or directory should print an error
• refactor: remove unused CommitOptions from generateBuildOutput
• stage_executor: generate output for cases with no commit
• stage_executor, commit: output only if last stage in build
• Use errors.Is() instead of os.Is{Not,}Exist
• Minor test tweak for podman-remote compatibility
• Cirrus: Use the latest imgts container
• imagebuildah: complain about the right Dockerfile
• tests: don't try to wrap nil errors
• cmd/buildah.commitCmd: don't shadow 'err'
• cmd/buildah.pullCmd: complain about DecryptConfig/EncryptConfig
• Fix a copy/paste error message
• Fix a typo in an error message
• build,cache: support pulling/pushing cache layers to/from remote sources
• Update vendor of containers/(common, storage, image)
• Rename chroot/run.go to chroot/run_linux.go
• Don't bother telling codespell to skip files that don't exist
• Set user namespace defaults correctly for the library
• imagebuildah: optimize cache hits for COPY and ADD instructions
• Cirrus: Update VM images w/ updated bats
• docs, run: show SELinux label flag for cache and bind mounts
• imagebuildah, build: remove undefined concurrent writes
• bump github.com/opencontainers/runtime-tools
• Add FreeBSD support for 'buildah info'
• Vendor in latest containers/(storage, common, image)
• Add freebsd cross build targets
• Make the jail package build on 32bit platforms
• Cirrus: Ensure the build-push VM image is labeled
• GHA: Fix dynamic script filename
• Vendor in containers/(common, storage, image)
• Run codespell
• Remove import of github.com/pkg/errors
• Avoid using cgo in pkg/jail
• Rename footypes to fooTypes for naming consistency
• Move cleanupTempVolumes and cleanupRunMounts to run_common.go
• Make the various run mounts work for FreeBSD
• Move get{Bind,Tmpfs,Secret,SSH}Mount to run_common.go
• Move runSetupRunMounts to run_common.go
• Move cleanableDestinationListFromMounts to run_common.go
• Make setupMounts and runSetupBuiltinVolumes work on FreeBSD
• Move setupMounts and runSetupBuiltinVolumes to run_common.go
• Tidy up - runMakeStdioPipe can't be shared with linux
• Move runAcceptTerminal to run_common.go
• Move stdio copying utilities to run_common.go
• Move runUsingRuntime and runCollectOutput to run_common.go
• Move fileCloser, waitForSync and contains to run_common.go
• Move checkAndOverrideIsolationOptions to run_common.go
• Move DefaultNamespaceOptions to run_common.go
• Move getNetworkInterface to run_common.go
• Move configureEnvironment to run_common.go
• Don't crash in configureUIDGID if Process.Capabilities is nil
• Move configureUIDGID to run_common.go
• Move runLookupPath to run_common.go
• Move setupTerminal to run_common.go
• Move etc file generation utilities to run_common.go
• Add run support for FreeBSD
• Add a simple FreeBSD jail library
• Add FreeBSD support to pkg/chrootuser
• Sync call signature for RunUsingChroot with chroot/run.go
• test: verify feature to resolve basename with args
• vendor: bump openshift/imagebuilder to master@4151e43…

This update for buildah fixes the following issues:

Version update to 1.28.2.

• CVE-2022-2990: Fixed a possible information disclosure and modification vulnerability (bsc#1202812).
• CVE-2020-10696: Fixed an issue with a crafted input tar file that may lead to a local file overwriting during image build process (bsc#1167864).

This update for buildah fixes the following issues:

Version update to 1.28.2.

• CVE-2022-2990: Fixed a possible information disclosure and modification vulnerability (bsc#1202812).
• CVE-2020-10696: Fixed an issue with a crafted input tar file that may lead to a local file overwriting during image build process (bsc#1167864).