{"action":"Upgrade github.com/containers/buildah to 1.33.12 or later.","affected":[{"fixed":"1.38.1","introduced":"1.38.0"},{"fixed":"1.37.6","introduced":"1.37.0"},{"fixed":"1.35.5","introduced":"1.35.0"},{"fixed":"1.33.12","introduced":"0"}],"component":"github.com/containers/buildah","cve_ids":["CVE-2024-11218"],"ecosystem":"Go","epss":0.00365,"exploited":false,"fixed_versions":["1.38.1","1.37.6","1.35.5","1.33.12"],"ghsa_id":"GHSA-5vpc-35f4-r8w6","id":"tcs_01M5KEYWF4DW3WCMQPZFYAXAAV","modified_at":"2026-09-10T03:50:21.870222134Z","published_at":"2025-01-21T21:22:49Z","references":["https://osv.dev/vulnerability/GHSA-5vpc-35f4-r8w6","https://github.com/containers/buildah/security/advisories/GHSA-5vpc-35f4-r8w6","https://nvd.nist.gov/vuln/detail/CVE-2024-11218","https://github.com/containers/buildah/pull/5918","https://access.redhat.com/errata/RHSA-2025:0830","https://access.redhat.com/errata/RHSA-2025:2441","https://access.redhat.com/errata/RHSA-2025:2443","https://access.redhat.com/errata/RHSA-2025:2454","https://access.redhat.com/errata/RHSA-2025:2456","https://access.redhat.com/errata/RHSA-2025:2701","https://access.redhat.com/errata/RHSA-2025:2703","https://access.redhat.com/errata/RHSA-2025:2710","https://access.redhat.com/errata/RHSA-2025:2712","https://access.redhat.com/errata/RHSA-2025:3577","https://access.redhat.com/errata/RHSA-2025:3798","https://access.redhat.com/security/cve/CVE-2024-11218","https://bugzilla.redhat.com/show_bug.cgi?id=2326231","https://github.com/containers/buildah","https://issues.redhat.com/browse/RHEL-67616","https://issues.redhat.com/browse/RHEL-67618","https://access.redhat.com/errata/RHSA-2025:0878","https://access.redhat.com/errata/RHSA-2025:0922","https://access.redhat.com/errata/RHSA-2025:0923","https://access.redhat.com/errata/RHSA-2025:1186","https://access.redhat.com/errata/RHSA-2025:1187","https://access.redhat.com/errata/RHSA-2025:1188","https://access.redhat.com/errata/RHSA-2025:1189","https://access.redhat.com/errata/RHSA-2025:1207","https://access.redhat.com/errata/RHSA-2025:1275","https://access.redhat.com/errata/RHSA-2025:1295","https://access.redhat.com/errata/RHSA-2025:1296","https://access.redhat.com/errata/RHSA-2025:1372","https://access.redhat.com/errata/RHSA-2025:1453","https://access.redhat.com/errata/RHSA-2025:1707","https://access.redhat.com/errata/RHSA-2025:1713","https://access.redhat.com/errata/RHSA-2025:1908","https://access.redhat.com/errata/RHSA-2025:1910","https://access.redhat.com/errata/RHSA-2025:1914"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-5vpc-35f4-r8w6","url":"https://osv.dev/vulnerability/GHSA-5vpc-35f4-r8w6"}],"summary":"Buildah allows build breakout using malicious Containerfiles and concurrent builds"}