CVE-2024-9676

CWE-22 — Path Traversal7 documents7 sources
Severity
6.5MEDIUM
EPSS
1.3%
top 20.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
15
Redhat Enterprise LinuxRedhat Enterprise Linux EUSRedhat Enterprise Linux FOR ARM 64+12 more
Timeline
PublishedOct 15

Description

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶Debiangolang-github-containers-storage< 1.55.1+ds1-1+1

Also affects: Openshift Container Platform 4.12, 4.13, 4.14, 4.15, 4.16, 4.17, Enterprise Linux 9.0, 9.4

🔴Vulnerability Details

3
CVEList
Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)↗2024-10-15
▶
GHSA
GHSA-wq2p-5pc6-wpgf: A vulnerability was found in Podman, Buildah, and CRI-O↗2024-10-15
▶
OSV
CVE-2024-9676: A vulnerability was found in Podman, Buildah, and CRI-O↗2024-10-15
▶

📋Vendor Advisories

3
Red Hat
Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)↗2024-10-15
▶
Microsoft
Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)↗2024-10-08
▶
Debian
CVE-2024-9676: golang-github-containers-storage - A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vul...↗2024
▶