buildah.advisories.yaml

schema-version: 2.0.2

package:
  name: buildah

advisories:
  - id: CGA-2vj4-5vmv-c77c
    aliases:
      - CVE-2021-3602
      - GHSA-7638-r9r3-rmjj
    events:
      - timestamp: 2024-04-29T16:12:09Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 7b4e246fde7193c2
            componentName: github.com/containers/buildah
            componentVersion: v0.0.0-20240329173728-9f0251c1111d
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-08-01T20:41:52Z
        type: false-positive-determination
        data:
          type: component-vulnerability-mismatch
          note: The CVE was against an older version of the buildah module itself (< v1.16.8), and this package includes v1.36.0.

  - id: CGA-2x82-jh2m-c6cj
    aliases:
      - CVE-2020-10696
      - GHSA-fx8w-mjvm-hvpc
    events:
      - timestamp: 2024-04-29T16:12:13Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 7b4e246fde7193c2
            componentName: github.com/containers/buildah
            componentVersion: v0.0.0-20240329173728-9f0251c1111d
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-08-01T20:41:52Z
        type: false-positive-determination
        data:
          type: component-vulnerability-mismatch
          note: The CVE was against an older version of the buildah module itself (< v1.14.4), and this package includes v1.36.0.

  - id: CGA-6q96-mpjg-2qg6
    aliases:
      - CVE-2024-3727
      - GHSA-6wvf-f2vw-3425
    events:
      - timestamp: 2024-05-22T07:35:35Z
        type: fixed
        data:
          fixed-version: 1.35.4-r0

  - id: CGA-7vvx-h4j3-7gm5
    aliases:
      - CVE-2024-41110
      - GHSA-v23v-6jw2-98fq
    events:
      - timestamp: 2024-07-31T08:31:32Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: ddcf5cb2cb7200e4
            componentName: github.com/docker/docker
            componentVersion: v26.1.3+incompatible
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-08-01T21:18:35Z
        type: fixed
        data:
          fixed-version: 1.37.0-r0

  - id: CGA-cm27-9fv3-3gp8
    aliases:
      - CVE-2024-24789
      - GHSA-236w-p7wf-5ph8
    events:
      - timestamp: 2024-06-07T08:35:33Z
        type: fixed
        data:
          fixed-version: 1.36.0-r1

  - id: CGA-gpr2-42c3-43rf
    aliases:
      - CVE-2022-27651
      - GHSA-c3g4-w6cv-6v7h
    events:
      - timestamp: 2024-04-29T16:12:10Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 7b4e246fde7193c2
            componentName: github.com/containers/buildah
            componentVersion: v0.0.0-20240329173728-9f0251c1111d
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-08-01T20:41:52Z
        type: false-positive-determination
        data:
          type: component-vulnerability-mismatch
          note: The CVE was against an older version of the buildah module itself (< v1.25.0), and this package includes v1.36.0.

  - id: CGA-gwv5-f7q2-wrgj
    aliases:
      - CVE-2024-24791
      - GHSA-hw49-2p59-3mhj
    events:
      - timestamp: 2024-07-04T07:03:50Z
        type: fixed
        data:
          fixed-version: 1.36.0-r2

  - id: CGA-jf43-cp2x-wvrw
    aliases:
      - CVE-2024-3154
      - GHSA-2cgq-h8xw-2v5j
      - GHSA-c5pj-mqfh-rvc3
    events:
      - timestamp: 2024-04-29T16:12:11Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 3574ad06307e3c4c
            componentName: github.com/opencontainers/runc
            componentVersion: v1.1.12
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-04-30T10:01:18Z
        type: fixed
        data:
          fixed-version: 1.35.3-r1

  - id: CGA-x59c-rc24-rqm2
    aliases:
      - CVE-2024-24790
      - GHSA-49gw-vxvf-fc2g
    events:
      - timestamp: 2024-06-07T08:35:35Z
        type: fixed
        data:
          fixed-version: 1.36.0-r1

  - id: CGA-x7mh-w3g6-2c7r
    aliases:
      - CVE-2022-2990
      - GHSA-fjm8-m7m6-2fjp
    events:
      - timestamp: 2024-04-29T16:12:12Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildah
            componentID: 7b4e246fde7193c2
            componentName: github.com/containers/buildah
            componentVersion: v0.0.0-20240329173728-9f0251c1111d
            componentType: go-module
            componentLocation: /bin/buildah
            scanner: grype
      - timestamp: 2024-08-01T20:41:52Z
        type: false-positive-determination
        data:
          type: component-vulnerability-mismatch
          note: The CVE was against an older version of the buildah module itself (< v1.27.1), and this package includes v1.36.0.