CVE-2020-10696: 
NixOS vulnerability analysis and mitigation

A path traversal vulnerability (CVE-2020-10696) was discovered in Buildah versions before 1.14.5. The vulnerability was disclosed on March 31, 2020. This flaw affects the Buildah container image building tool, which is used for creating OCI container images. The vulnerability allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions (NVD, Red Hat).

The vulnerability is classified as a path traversal flaw (CWE-22) with a CVSS v3.1 base score of 8.8 (HIGH). The issue occurs during the container image building process where a crafted tar file containing symlinks may lead Buildah to overwrite any file which the running UID has write permissions. The vulnerability stems from Buildah's behavior when it fails to fetch content used as a parameter for building - it attempts to refetch the content without properly cleaning up the build directory (Red Hat Bugzilla).

The vulnerability can compromise confidentiality and integrity of the system by allowing an attacker to overwrite any existing file to which the task's owner has write access. This could potentially lead to code execution in certain circumstances. The impact is particularly significant in environments where Buildah is used for container image building operations (Red Hat Bugzilla).

The vulnerability was fixed in Buildah version 1.14.5. Red Hat has released security updates for affected products through multiple security advisories including RHSA-2020:2116 for Red Hat Enterprise Linux 7 Extras. The fix prevents the refetching of content after a file read failure, which could previously be exploited using symlinks to overwrite good files with malicious data (Red Hat Advisory).

Red Hat initially rated this update as having a security impact of Important. However, for OpenShift Container Platform, while it included the vulnerable Buildah code, it was noted that it didn't make use of the vulnerable function. The impact was consequently given a low rating for OpenShift Container Platform as Podman isn't used to perform builds in this context (Red Hat Bugzilla).