View at Official suse advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2021-3602 severity moderate: SUSE including 75 source package names (1.8.6.0.3.2.5:libseccomp2-2.5.3-150300.10.5.1, 14.1-rev1.0.0-build2.2.43:libseccomp2-2.5.3-150300.10.5.1, …), 176 product×package rows across 82 product lines (Container bci/bci-init, Container ses/7.1/ceph/haproxy, … (82 product lines)): Fixed 158, Will Not Fix 16, Known Not Affected 2.
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).