CVE-2024-3727 Containers/image: digest type does not guarantee valid type
Attackers can trigger unexpected registry accesses causing resource exhaustion and local path traversal in the containers/image library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-3727?
CVE-2024-3727 is a high-severity path traversal vulnerability in Red Hat Multicluster Engine for Kubernetes, published on 9 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
Weakness: CWE-354
Which versions are affected by CVE-2024-3727?
7 open source packages ship an affected version, including github.com/containers/image/v5 and github.com/containers/image.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containers/image/v5 Go | All versions | 5.29.3, 5.30.1 |
github.com/containers/image/v5 Go | All versions | 5.29.3 |
github.com/containers/image/v5 Go | All versions | 5.29.3 |
github.com/containers/image/v5 Go | From 5.30.0 | 5.30.1 |
github.com/containers/image/v5 Go | From 5.30.0 | 5.30.1 |
github.com/containers/image Go | All versions | 5.30.1 |
1 more packages
github.com/containers/image Go | All versions | 5.30.1 |
Linux distribution packages (21)
podman SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 2.1.1-150100.4.31.1 |
skopeo SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 0.1.41-150000.4.23.1 |
containerized-data-importer SUSE:Linux Enterprise Micro 5.5 | All versions | 1.58.0-150500.6.15.1 |
containerized-data-importer SUSE:Linux Enterprise Module for Containers 15 SP5 | All versions | 1.58.0-150500.6.15.1 |
containerized-data-importer SUSE:Linux Enterprise Module for Containers 15 SP6 | All versions | 1.58.0-150600.3.3.2 |
warewulf4 SUSE:Linux Enterprise Module for HPC 15 SP5 | All versions | 4.5.2-150500.6.13.1 |
warewulf4 SUSE:Linux Enterprise Module for HPC 15 SP6 | All versions | 4.5.2-150500.6.13.1 |
podman SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 2.1.1-150100.4.31.1 |
skopeo SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 0.1.41-150000.4.23.1 |
podman SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 2.1.1-150100.4.31.1 |
skopeo SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 0.1.41-150000.4.23.1 |
containerized-data-importer SUSE:Linux Micro 6.0 | All versions | 1.60.1-1.1 |
containerized-data-importer openSUSE:Leap 15.5 | All versions | 1.58.0-150500.6.15.1 |
warewulf4 openSUSE:Leap 15.5 | All versions | 4.5.2-150500.6.13.1 |
containerized-data-importer openSUSE:Leap 15.6 | All versions | 1.58.0-150600.3.3.2 |
warewulf4 openSUSE:Leap 15.6 | All versions | 4.5.2-150500.6.13.1 |
apptainer openSUSE:Tumbleweed | All versions | 1.3.0-2.1 |
containerized-data-importer-1.65 openSUSE:Tumbleweed | All versions | 1.65.0-1.1 |
containerized-data-importer1.65 openSUSE:Tumbleweed | All versions | 1.65.0-1.1 |
podman openSUSE:Tumbleweed | All versions | 5.0.3-1.1 |
skopeo openSUSE:Tumbleweed | All versions | 1.15.1-1.1 |
How do I fix CVE-2024-3727?
Upgrade github.com/containers/image/v5 to a fixed version for your release line: 5.29.3 or 5.30.1.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-3727 being exploited?
There is no known exploitation of CVE-2024-3727 in the wild and no public exploit code.
Sources
Also known as AZL-42315, AZL-42318, AZL-42319, AZL-42327, AZL-42330, AZL-42331 and 26 more.