https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:30:29.546922+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-44517 BELL-CVE-2026-44517 2026-10-02T23:30:29.627578+00:00

Affected: Alpaquita:stream: podman

 https://cve.radiocsirt.org/vuln/euvd-2026-358860 EUVD-2026-358860 2026-10-02T23:30:29.627631+00:00 EUVD-2026-358860 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44517 fkie_cve-2026-44517 2026-10-02T23:30:29.627646+00:00

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0.

 https://cve.radiocsirt.org/vuln/ghsa-49p4-px3h-rq49 GHSA-49p4-px3h-rq49 — Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive 2026-10-02T23:30:29.627676+00:00

Affected: Go: github.com/containers/buildah

### Impact

When processing a build contexts or `add`/`copy` instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build.

### Patches

Fixed in Buildah 1.44 and 1.43.2.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44517 UBUNTU-CVE-2026-44517 2026-10-02T23:30:29.627701+00:00

Affected: Ubuntu:22.04:LTS: golang-github-containers-buildah, Ubuntu:Pro:24.04:LTS: golang-github-containers-buildah, Ubuntu:25.10: golang-github-containers-buildah, Ubuntu:Pro:26.04:LTS: golang-github-containers-buildah

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0.