{"action":"Upgrade github.com/containers/buildah to 1.27.1 or later.","affected":[{"fixed":"1.27.1","introduced":"0"}],"component":"github.com/containers/buildah","cve_ids":["CVE-2022-2990"],"ecosystem":"Go","epss":0.00349,"exploited":false,"fixed_versions":["1.27.1"],"ghsa_id":"GHSA-fjm8-m7m6-2fjp","id":"tcs_01M5KF9CDZBJ6MW5ESV2PWNKNJ","modified_at":"2026-09-10T03:49:45.362162826Z","published_at":"2022-09-14T00:00:48Z","references":["https://osv.dev/vulnerability/GHSA-fjm8-m7m6-2fjp","https://nvd.nist.gov/vuln/detail/CVE-2022-2990","https://github.com/containers/buildah/pull/4200","https://github.com/containers/buildah/commit/4a8bf740e862f2438279c6feee2ea59ddf0cda0b","https://access.redhat.com/security/cve/CVE-2022-2990","https://bugzilla.redhat.com/show_bug.cgi?id=2121453","https://github.com/containers/buildah","https://pkg.go.dev/vuln/GO-2022-1008","https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-fjm8-m7m6-2fjp","url":"https://osv.dev/vulnerability/GHSA-fjm8-m7m6-2fjp"}],"summary":"Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification"}