csaf_suse - suse-su-2025:0267-1

suse-su-2025:0267-1

Vulnerability from csaf_suse

Published

2025-01-28 11:25

Modified

2025-01-28 11:25

Summary

Security update for podman

Notes

Title of the patch

Security update for podman

Description of the patch

This update for podman fixes the following issues: - CVE-2024-9676: github.com/containers/storage: Fixed symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (bsc#1231698) - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - CVE-2024-9675: Fixed cache arbitrary directory mount in buildah (bsc#1231499) - CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction in buildah (bsc#1231208) - CVE-2024-9341: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (bsc#1231230) - CVE-2024-1753: Fixed full container escape at build time in buildah (bsc#1221677) - CVE-2024-11218: Fixed a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. (bsc#1236270) - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available

Patchnames

SUSE-2025-267,SUSE-SLE-Micro-5.3-2025-267,SUSE-SLE-Micro-5.4-2025-267,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-267,SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-267,SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-267,SUSE-SLE-Product-SLES_SAP-15-SP4-2025-267

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for podman",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThis update for podman fixes the following issues:\n\n- CVE-2024-9676: github.com/containers/storage: Fixed symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (bsc#1231698) \n\n- Load ip_tables and ip6_tables kernel module (bsc#1214612)\n  * Required for rootless mode as a regular user has no permission\n    to load kernel modules\n\n- CVE-2024-9675: Fixed cache arbitrary directory mount in buildah (bsc#1231499)\n- CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction in buildah (bsc#1231208)\n- CVE-2024-9341: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (bsc#1231230)\n- CVE-2024-1753: Fixed full container escape at build time in buildah (bsc#1221677)\n- CVE-2024-11218: Fixed a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. (bsc#1236270)\n\n- Refactor network backend dependencies:\n  * podman requires either netavark or cni-plugins. On ALP, require\n    netavark, otherwise prefer netavark but don\u0027t force it.\n  * This fixes missing cni-plugins in some scenarios\n  * Default to netavark everywhere where it\u0027s available\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2025-267,SUSE-SLE-Micro-5.3-2025-267,SUSE-SLE-Micro-5.4-2025-267,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-267,SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-267,SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-267,SUSE-SLE-Product-SLES_SAP-15-SP4-2025-267",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0267-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:0267-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-20250267-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:0267-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020225.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1214612",
        "url": "https://bugzilla.suse.com/1214612"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1215807",
        "url": "https://bugzilla.suse.com/1215807"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1215926",
        "url": "https://bugzilla.suse.com/1215926"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1217828",
        "url": "https://bugzilla.suse.com/1217828"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1221677",
        "url": "https://bugzilla.suse.com/1221677"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1231208",
        "url": "https://bugzilla.suse.com/1231208"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1231230",
        "url": "https://bugzilla.suse.com/1231230"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1231499",
        "url": "https://bugzilla.suse.com/1231499"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1231698",
        "url": "https://bugzilla.suse.com/1231698"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1236270",
        "url": "https://bugzilla.suse.com/1236270"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-11218 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-11218/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-1753 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-1753/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9341 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9341/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9407 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9407/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9675 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9675/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9676 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9676/"
      }
    ],
    "title": "Security update for podman",
    "tracking": {
      "current_release_date": "2025-01-28T11:25:30Z",
      "generator": {
        "date": "2025-01-28T11:25:30Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:0267-1",
      "initial_release_date": "2025-01-28T11:25:30Z",
      "revision_history": [
        {
          "date": "2025-01-28T11:25:30Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-4.9.5-150400.4.35.1.aarch64",
                "product": {
                  "name": "podman-4.9.5-150400.4.35.1.aarch64",
                  "product_id": "podman-4.9.5-150400.4.35.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-4.9.5-150400.4.35.1.aarch64",
                "product": {
                  "name": "podman-remote-4.9.5-150400.4.35.1.aarch64",
                  "product_id": "podman-remote-4.9.5-150400.4.35.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "podmansh-4.9.5-150400.4.35.1.aarch64",
                "product": {
                  "name": "podmansh-4.9.5-150400.4.35.1.aarch64",
                  "product_id": "podmansh-4.9.5-150400.4.35.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-4.9.5-150400.4.35.1.i586",
                "product": {
                  "name": "podman-4.9.5-150400.4.35.1.i586",
                  "product_id": "podman-4.9.5-150400.4.35.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-4.9.5-150400.4.35.1.i586",
                "product": {
                  "name": "podman-remote-4.9.5-150400.4.35.1.i586",
                  "product_id": "podman-remote-4.9.5-150400.4.35.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "podmansh-4.9.5-150400.4.35.1.i586",
                "product": {
                  "name": "podmansh-4.9.5-150400.4.35.1.i586",
                  "product_id": "podmansh-4.9.5-150400.4.35.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-docker-4.9.5-150400.4.35.1.noarch",
                "product": {
                  "name": "podman-docker-4.9.5-150400.4.35.1.noarch",
                  "product_id": "podman-docker-4.9.5-150400.4.35.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-4.9.5-150400.4.35.1.ppc64le",
                "product": {
                  "name": "podman-4.9.5-150400.4.35.1.ppc64le",
                  "product_id": "podman-4.9.5-150400.4.35.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-4.9.5-150400.4.35.1.ppc64le",
                "product": {
                  "name": "podman-remote-4.9.5-150400.4.35.1.ppc64le",
                  "product_id": "podman-remote-4.9.5-150400.4.35.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "podmansh-4.9.5-150400.4.35.1.ppc64le",
                "product": {
                  "name": "podmansh-4.9.5-150400.4.35.1.ppc64le",
                  "product_id": "podmansh-4.9.5-150400.4.35.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-4.9.5-150400.4.35.1.s390x",
                "product": {
                  "name": "podman-4.9.5-150400.4.35.1.s390x",
                  "product_id": "podman-4.9.5-150400.4.35.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-4.9.5-150400.4.35.1.s390x",
                "product": {
                  "name": "podman-remote-4.9.5-150400.4.35.1.s390x",
                  "product_id": "podman-remote-4.9.5-150400.4.35.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "podmansh-4.9.5-150400.4.35.1.s390x",
                "product": {
                  "name": "podmansh-4.9.5-150400.4.35.1.s390x",
                  "product_id": "podmansh-4.9.5-150400.4.35.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-4.9.5-150400.4.35.1.x86_64",
                "product": {
                  "name": "podman-4.9.5-150400.4.35.1.x86_64",
                  "product_id": "podman-4.9.5-150400.4.35.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-4.9.5-150400.4.35.1.x86_64",
                "product": {
                  "name": "podman-remote-4.9.5-150400.4.35.1.x86_64",
                  "product_id": "podman-remote-4.9.5-150400.4.35.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "podmansh-4.9.5-150400.4.35.1.x86_64",
                "product": {
                  "name": "podmansh-4.9.5-150400.4.35.1.x86_64",
                  "product_id": "podmansh-4.9.5-150400.4.35.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.3",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.3",
                  "product_id": "SUSE Linux Enterprise Micro 5.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.4",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.4",
                  "product_id": "SUSE Linux Enterprise Micro 5.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.aarch64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.s390x as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.x86_64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.aarch64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.s390x as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.x86_64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-docker-4.9.5-150400.4.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch"
        },
        "product_reference": "podman-docker-4.9.5-150400.4.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-docker-4.9.5-150400.4.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch"
        },
        "product_reference": "podman-docker-4.9.5-150400.4.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.s390x as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-docker-4.9.5-150400.4.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch"
        },
        "product_reference": "podman-docker-4.9.5-150400.4.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.s390x as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-4.9.5-150400.4.35.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64"
        },
        "product_reference": "podman-4.9.5-150400.4.35.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-docker-4.9.5-150400.4.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch"
        },
        "product_reference": "podman-docker-4.9.5-150400.4.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-4.9.5-150400.4.35.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
        },
        "product_reference": "podman-remote-4.9.5-150400.4.35.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-11218",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-11218"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-11218",
          "url": "https://www.suse.com/security/cve/CVE-2024-11218"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236269 for CVE-2024-11218",
          "url": "https://bugzilla.suse.com/1236269"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-28T11:25:30Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-11218"
    },
    {
      "cve": "CVE-2024-1753",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-1753"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-1753",
          "url": "https://www.suse.com/security/cve/CVE-2024-1753"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1221677 for CVE-2024-1753",
          "url": "https://bugzilla.suse.com/1221677"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-28T11:25:30Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-1753"
    },
    {
      "cve": "CVE-2024-9341",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9341"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9341",
          "url": "https://www.suse.com/security/cve/CVE-2024-9341"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231230 for CVE-2024-9341",
          "url": "https://bugzilla.suse.com/1231230"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-28T11:25:30Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9341"
    },
    {
      "cve": "CVE-2024-9407",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9407"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9407",
          "url": "https://www.suse.com/security/cve/CVE-2024-9407"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231208 for CVE-2024-9407",
          "url": "https://bugzilla.suse.com/1231208"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-28T11:25:30Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9407"
    },
    {
      "cve": "CVE-2024-9675",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9675"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9675",
          "url": "https://www.suse.com/security/cve/CVE-2024-9675"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231499 for CVE-2024-9675",
          "url": "https://bugzilla.suse.com/1231499"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-28T11:25:30Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9675"
    },
    {
      "cve": "CVE-2024-9676",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9676"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9676",
          "url": "https://www.suse.com/security/cve/CVE-2024-9676"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231698 for CVE-2024-9676",
          "url": "https://bugzilla.suse.com/1231698"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231785 for CVE-2024-9676",
          "url": "https://bugzilla.suse.com/1231785"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.s390x",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:podman-remote-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-4.9.5-150400.4.35.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-docker-4.9.5-150400.4.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:podman-remote-4.9.5-150400.4.35.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-28T11:25:30Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9676"
    }
  ]
}

CVE-2024-1753 (GCVE-0-2024-1753)

Vulnerability from cvelistv5

Published

2024-03-18 14:23

Modified

2025-08-01 18:14

Severity ?

8.6 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Summary

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

References

►

URL

Tags

	https://access.redhat.com/errata/RHSA-2024:2049	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2055	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2064	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2066	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2077	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2084	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2089	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2090	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2097	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2098	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2548	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2645	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2669	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2672	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2784	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2877	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:3254	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2024-1753	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2265513	issue-tracking, x_refsource_REDHAT
	https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf
	https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3
	https://pkg.go.dev/vuln/GO-2024-2658

Impacted products

Vendor

Product

Version

►

Version: 4.15.0

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8090020240413110917.d7b6f4b7 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8090020240417184044.e7857ab1 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020240419145834.afee755d < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	Unaffected: 8060020240422155330.3b538bd8 < * cpe:/a:redhat:rhel_eus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	Unaffected: 8060020240419071711.2e213529 < * cpe:/a:redhat:rhel_eus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 8080020240422101606.0f77c1b7 < * cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 1:1.31.5-1.el9_3 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 4:4.9.4-3.el9_4 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	Unaffected: 1:1.26.7-1.el9_0 < * cpe:/a:redhat:rhel_eus:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	Unaffected: 2:4.2.0-3.el9_0 < * cpe:/a:redhat:rhel_eus:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 1:1.29.3-1.el9_2 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 2:4.4.1-16.el9_2 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 3:4.4.1-3.2.rhaos4.12.el8 < * cpe:/a:redhat:openshift:4.12::el8 cpe:/a:redhat:openshift:4.12::el9
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 3:4.4.1-5.3.rhaos4.13.el8 < * cpe:/a:redhat:openshift:4.13::el9 cpe:/a:redhat:openshift:4.13::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 3:4.4.1-8.3.rhaos4.13.el9 < * cpe:/a:redhat:openshift:4.13::el9 cpe:/a:redhat:openshift:4.13::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 3:4.4.1-13.4.rhaos4.14.el8 < * cpe:/a:redhat:openshift:4.14::el8 cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 3:4.4.1-23.2.rhaos4.15.el8 < * cpe:/a:redhat:openshift:4.15::el8 cpe:/a:redhat:openshift:4.15::el9
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat OpenShift Container Platform 3.11	cpe:/a:redhat:openshift:3.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1753",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-02T15:05:28.144862Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:00:10.892Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:48:22.005Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2024:2049",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2049"
          },
          {
            "name": "RHSA-2024:2055",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2055"
          },
          {
            "name": "RHSA-2024:2064",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2064"
          },
          {
            "name": "RHSA-2024:2066",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2066"
          },
          {
            "name": "RHSA-2024:2077",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2077"
          },
          {
            "name": "RHSA-2024:2084",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2084"
          },
          {
            "name": "RHSA-2024:2089",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2089"
          },
          {
            "name": "RHSA-2024:2090",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2090"
          },
          {
            "name": "RHSA-2024:2097",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2097"
          },
          {
            "name": "RHSA-2024:2098",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2098"
          },
          {
            "name": "RHSA-2024:2548",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2548"
          },
          {
            "name": "RHSA-2024:2645",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2645"
          },
          {
            "name": "RHSA-2024:2669",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2669"
          },
          {
            "name": "RHSA-2024:2672",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2672"
          },
          {
            "name": "RHSA-2024:2784",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2784"
          },
          {
            "name": "RHSA-2024:2877",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2877"
          },
          {
            "name": "RHSA-2024:3254",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:3254"
          },
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2024-1753"
          },
          {
            "name": "RHBZ#2265513",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265513"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCRZVUDOFM5CPREQKBEU2VK2QK62PSBP/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYMVMQ7RWMDTSKQTBO734BE3WQPI2AJ/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVBSVZGVABPYIHK5HZM472NPGWMI7WXH/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/openshift/builder/",
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "versions": [
            {
              "status": "affected",
              "version": "4.15.0"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:4.0",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8090020240413110917.d7b6f4b7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8090020240417184044.e7857ab1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020240419145834.afee755d",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020240422155330.3b538bd8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:4.0",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020240419071711.2e213529",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020240422101606.0f77c1b7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.31.5-1.el9_3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:4.9.4-3.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.26.7-1.el9_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:4.2.0-3.el9_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.29.3-1.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:4.4.1-16.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.12::el8",
            "cpe:/a:redhat:openshift:4.12::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.12",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-3.2.rhaos4.12.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-5.3.rhaos4.13.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-8.3.rhaos4.13.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el8",
            "cpe:/a:redhat:openshift:4.14::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-13.4.rhaos4.14.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el8",
            "cpe:/a:redhat:openshift:4.15::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-23.2.rhaos4.15.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:3.11"
          ],
          "defaultStatus": "unknown",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 3.11",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2024-03-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-01T18:14:15.934Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:2049",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2049"
        },
        {
          "name": "RHSA-2024:2055",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2055"
        },
        {
          "name": "RHSA-2024:2064",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2064"
        },
        {
          "name": "RHSA-2024:2066",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2066"
        },
        {
          "name": "RHSA-2024:2077",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2077"
        },
        {
          "name": "RHSA-2024:2084",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2084"
        },
        {
          "name": "RHSA-2024:2089",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2089"
        },
        {
          "name": "RHSA-2024:2090",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2090"
        },
        {
          "name": "RHSA-2024:2097",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2097"
        },
        {
          "name": "RHSA-2024:2098",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2098"
        },
        {
          "name": "RHSA-2024:2548",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2548"
        },
        {
          "name": "RHSA-2024:2645",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2645"
        },
        {
          "name": "RHSA-2024:2669",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2669"
        },
        {
          "name": "RHSA-2024:2672",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2672"
        },
        {
          "name": "RHSA-2024:2784",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2784"
        },
        {
          "name": "RHSA-2024:2877",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2877"
        },
        {
          "name": "RHSA-2024:3254",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:3254"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-1753"
        },
        {
          "name": "RHBZ#2265513",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265513"
        },
        {
          "url": "https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf"
        },
        {
          "url": "https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2658"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-02-22T00:00:00+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-03-18T00:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Buildah: full container escape at build time",
      "workarounds": [
        {
          "lang": "en",
          "value": "When SELinux is enabled, the container is restricted to limited read-only access."
        }
      ],
      "x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-1753",
    "datePublished": "2024-03-18T14:23:44.213Z",
    "dateReserved": "2024-02-22T14:42:20.623Z",
    "dateUpdated": "2025-08-01T18:14:15.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9341 (GCVE-0-2024-9341)

Vulnerability from cvelistv5

Published

2024-10-01 18:52

Modified

2025-08-02 22:29

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Summary

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.

References

►

URL

Tags

	https://access.redhat.com/errata/RHSA-2024:10147	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:10818	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:7925	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8039	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8112	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8238	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8263	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8428	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8690	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8694	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8846	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9454	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9459	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2024-9341	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2315691	issue-tracking, x_refsource_REDHAT
	https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L169
	https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L349

Impacted products

Vendor

Product

Version

►

Version: 0 ≤

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020241023085649.afee755d < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 4:4.9.4-13.el9_4 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.33.9-1.el9_4 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 4:5.2.2-9.el9_5 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.37.5-1.el9_5 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 0:1.25.5-5.rhaos4.12.git53dc492.el9 < * cpe:/a:redhat:openshift:4.12::el8 cpe:/a:redhat:openshift:4.12::el9 cpe:/a:redhat:openshift_ironic:4.12::el9
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 0:1.26.5-26.rhaos4.13.giteb3d487.el9 < * cpe:/a:redhat:openshift:4.13::el9 cpe:/a:redhat:openshift:4.13::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 0:1.27.8-10.rhaos4.14.git807f92c.el8 < * cpe:/a:redhat:openshift:4.14::el8 cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 0:1.28.11-5.rhaos4.15.git35a2431.el8 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:1.29.9-5.rhaos4.16.git34690b9.el8 < * cpe:/a:redhat:openshift:4.16::el9 cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 416.94.202411201433-0 < * cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 0:1.30.6-3.rhaos4.17.git49b5172.el8 < * cpe:/a:redhat:openshift:4.17::el9 cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202412040832-0 < * cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9341",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-01T19:23:28.683055Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-01T19:23:37.158Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/containers/common",
          "defaultStatus": "unaffected",
          "packageName": "github.com/containers/common",
          "versions": [
            {
              "lessThan": "0.60.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020241023085649.afee755d",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:4.9.4-13.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.33.9-1.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:5.2.2-9.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.37.5-1.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.12::el8",
            "cpe:/a:redhat:openshift:4.12::el9",
            "cpe:/a:redhat:openshift_ironic:4.12::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "cri-o",
          "product": "Red Hat OpenShift Container Platform 4.12",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.25.5-5.rhaos4.12.git53dc492.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "cri-o",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.26.5-26.rhaos4.13.giteb3d487.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el8",
            "cpe:/a:redhat:openshift:4.14::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "cri-o",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.27.8-10.rhaos4.14.git807f92c.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "cri-o",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.28.11-5.rhaos4.15.git35a2431.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9",
            "cpe:/a:redhat:openshift:4.16::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "cri-o",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.29.9-5.rhaos4.16.git34690b9.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "416.94.202411201433-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9",
            "cpe:/a:redhat:openshift:4.17::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "cri-o",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.30.6-3.rhaos4.17.git49b5172.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "417.94.202412040832-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-docker-builder",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Paul Holzinger for reporting this issue."
        }
      ],
      "datePublic": "2024-10-01T15:45:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-02T22:29:53.388Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:10147",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:10147"
        },
        {
          "name": "RHSA-2024:10818",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:10818"
        },
        {
          "name": "RHSA-2024:7925",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:7925"
        },
        {
          "name": "RHSA-2024:8039",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8039"
        },
        {
          "name": "RHSA-2024:8112",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8112"
        },
        {
          "name": "RHSA-2024:8238",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8238"
        },
        {
          "name": "RHSA-2024:8263",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8263"
        },
        {
          "name": "RHSA-2024:8428",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8428"
        },
        {
          "name": "RHSA-2024:8690",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8690"
        },
        {
          "name": "RHSA-2024:8694",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8694"
        },
        {
          "name": "RHSA-2024:8846",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8846"
        },
        {
          "name": "RHSA-2024:9454",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9454"
        },
        {
          "name": "RHSA-2024:9459",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9459"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-9341"
        },
        {
          "name": "RHBZ#2315691",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315691"
        },
        {
          "url": "https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L169"
        },
        {
          "url": "https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L349"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-09-30T15:18:57.587000+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-10-01T15:45:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-9341",
    "datePublished": "2024-10-01T18:52:00.686Z",
    "dateReserved": "2024-09-30T15:19:22.496Z",
    "dateUpdated": "2025-08-02T22:29:53.388Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9675 (GCVE-0-2024-9675)

Vulnerability from cvelistv5

Published

2024-10-09 14:32

Modified

2025-07-23 18:13

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Summary

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

References

►

URL

Tags

	https://access.redhat.com/errata/RHSA-2024:8563	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8675	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8679	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8686	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8690	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8700	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8703	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8707	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8708	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8709	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8846	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8984	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8994	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9051	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9454	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9459	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2445	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2449	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2454	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2701	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2710	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:3301	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:3573	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2024-9675	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2317458	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

►

Version: 0 ≤

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020241023085649.afee755d < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 8060020241028154646.3b538bd8 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 8060020241028154646.3b538bd8 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 8060020241028154646.3b538bd8 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 8080020241025064551.0f77c1b7 < * cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.33.10-1.el9_4 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 4:4.9.4-16.el9_4 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 4:5.2.2-9.el9_5 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.37.5-1.el9_5 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	Unaffected: 1:1.26.8-2.el9_0 < * cpe:/a:redhat:rhel_eus:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	Unaffected: 2:4.2.0-5.el9_0.2 < * cpe:/a:redhat:rhel_eus:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 1:1.29.4-1.el9_2 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 2:4.4.1-21.el9_2 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: v4.12.0-202503181728.p0.ge355452.assembly.stream.el8 < * cpe:/a:redhat:openshift:4.12::el9 cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 3:4.4.1-16.rhaos4.13.el9 < * cpe:/a:redhat:openshift:4.13::el8 cpe:/a:redhat:openshift:4.13::el9
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: v4.13.0-202503111300.p0.gb379980.assembly.stream.el8 < * cpe:/a:redhat:openshift:4.13::el8 cpe:/a:redhat:openshift:4.13::el9
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 3:4.4.1-21.rhaos4.14.el8 < * cpe:/a:redhat:openshift:4.14::el8 cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: v4.14.0-202503060906.p0.gb03f3f5.assembly.stream.el8 < * cpe:/a:redhat:openshift:4.14::el8 cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 3:4.4.1-32.rhaos4.15.el8 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202503060734.p0.gbc0b789.assembly.stream.el8 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 4:4.9.4-12.rhaos4.16.el8 < * cpe:/a:redhat:openshift:4.16::el8 cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: v4.16.0-202503121138.p0.g31c3c26.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 5:5.2.2-1.rhaos4.17.el9 < * cpe:/a:redhat:openshift:4.17::el8 cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: v4.17.0-202503041005.p0.gc3b0999.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: v4.18.0-202503040802.p0.g6a5ec2a.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.18::el9
Red Hat	OpenShift Developer Tools and Services	cpe:/a:redhat:ocp_tools
Red Hat	OpenShift Developer Tools and Services	cpe:/a:redhat:ocp_tools
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat Quay 3	cpe:/a:redhat:quay:3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9675",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-09T16:16:25.550764Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-09T16:24:34.705Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/containers/buildah",
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "versions": [
            {
              "lessThan": "1.38.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020241023085649.afee755d",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/a:redhat:rhel_aus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020241028154646.3b538bd8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/a:redhat:rhel_aus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020241028154646.3b538bd8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/a:redhat:rhel_aus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020241028154646.3b538bd8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020241025064551.0f77c1b7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.33.10-1.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:4.9.4-16.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:5.2.2-9.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.37.5-1.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.26.8-2.el9_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:4.2.0-5.el9_0.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.29.4-1.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:4.4.1-21.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.12::el9",
            "cpe:/a:redhat:openshift:4.12::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-docker-builder",
          "product": "Red Hat OpenShift Container Platform 4.12",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.12.0-202503181728.p0.ge355452.assembly.stream.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el8",
            "cpe:/a:redhat:openshift:4.13::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-16.rhaos4.13.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el8",
            "cpe:/a:redhat:openshift:4.13::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-docker-builder",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.13.0-202503111300.p0.gb379980.assembly.stream.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el8",
            "cpe:/a:redhat:openshift:4.14::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-21.rhaos4.14.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el8",
            "cpe:/a:redhat:openshift:4.14::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-docker-builder",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.14.0-202503060906.p0.gb03f3f5.assembly.stream.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-32.rhaos4.15.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-docker-builder",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202503060734.p0.gbc0b789.assembly.stream.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el8",
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:4.9.4-12.rhaos4.16.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-docker-builder-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.16.0-202503121138.p0.g31c3c26.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el8",
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "5:5.2.2-1.rhaos4.17.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-docker-builder-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.17.0-202503041005.p0.gc3b0999.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-docker-builder-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.18.0-202503040802.p0.g6a5ec2a.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ocp_tools"
          ],
          "defaultStatus": "affected",
          "packageName": "ocp-tools-4/jenkins-agent-base-rhel8",
          "product": "OpenShift Developer Tools and Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ocp_tools"
          ],
          "defaultStatus": "affected",
          "packageName": "ocp-tools-4/jenkins-rhel8",
          "product": "OpenShift Developer Tools and Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "skopeo",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "conmon",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "conmon",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "cri-o",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:quay:3"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-builder-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Erik Sj\u00f6lund (Upstream) for reporting this issue."
        }
      ],
      "datePublic": "2024-10-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-23T18:13:54.114Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:8563",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8563"
        },
        {
          "name": "RHSA-2024:8675",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8675"
        },
        {
          "name": "RHSA-2024:8679",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8679"
        },
        {
          "name": "RHSA-2024:8686",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8686"
        },
        {
          "name": "RHSA-2024:8690",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8690"
        },
        {
          "name": "RHSA-2024:8700",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8700"
        },
        {
          "name": "RHSA-2024:8703",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8703"
        },
        {
          "name": "RHSA-2024:8707",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8707"
        },
        {
          "name": "RHSA-2024:8708",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8708"
        },
        {
          "name": "RHSA-2024:8709",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8709"
        },
        {
          "name": "RHSA-2024:8846",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8846"
        },
        {
          "name": "RHSA-2024:8984",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8984"
        },
        {
          "name": "RHSA-2024:8994",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8994"
        },
        {
          "name": "RHSA-2024:9051",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9051"
        },
        {
          "name": "RHSA-2024:9454",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9454"
        },
        {
          "name": "RHSA-2024:9459",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9459"
        },
        {
          "name": "RHSA-2025:2445",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2445"
        },
        {
          "name": "RHSA-2025:2449",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2449"
        },
        {
          "name": "RHSA-2025:2454",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2454"
        },
        {
          "name": "RHSA-2025:2701",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2701"
        },
        {
          "name": "RHSA-2025:2710",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2710"
        },
        {
          "name": "RHSA-2025:3301",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:3301"
        },
        {
          "name": "RHSA-2025:3573",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:3573"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-9675"
        },
        {
          "name": "RHBZ#2317458",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317458"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-10-09T02:45:06.343000+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-10-09T00:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Buildah: buildah allows arbitrary directory mount",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_redhatCweChain": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-9675",
    "datePublished": "2024-10-09T14:32:11.922Z",
    "dateReserved": "2024-10-09T02:47:50.357Z",
    "dateUpdated": "2025-07-23T18:13:54.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9676 (GCVE-0-2024-9676)

Vulnerability from cvelistv5

Published

2024-10-15 15:27

Modified

2025-08-06 05:18

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Summary

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.

References

►

URL

Tags

	https://access.redhat.com/errata/RHSA-2024:10289	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8418	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8428	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8437	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8686	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8690	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8694	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8700	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8984	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9051	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9454	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9459	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9926	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:0876	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2454	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2710	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:3301	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2024-9676	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2317467	issue-tracking, x_refsource_REDHAT
	https://github.com/advisories/GHSA-wq2p-5pc6-wpgf

Impacted products

Vendor

Product

Version

►

Version: 0 ≤

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020241101101019.afee755d < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 4:4.9.4-16.el9_4 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 4:5.2.2-9.el9_5 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.37.5-1.el9_5 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 2:1.33.11-1.el9_4 < * cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 0:1.25.5-30.rhaos4.12.git53dc492.el8 < * cpe:/a:redhat:openshift:4.12::el8 cpe:/a:redhat:openshift_ironic:4.12::el9 cpe:/a:redhat:openshift:4.12::el9
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 0:1.26.5-26.rhaos4.13.giteb3d487.el8 < * cpe:/a:redhat:openshift:4.13::el9 cpe:/a:redhat:openshift:4.13::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 0:1.27.8-12.rhaos4.14.git7597c43.el9 < * cpe:/a:redhat:openshift:4.14::el9 cpe:/a:redhat:openshift:4.14::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: v4.14.0-202503060906.p0.gb03f3f5.assembly.stream.el8 < * cpe:/a:redhat:openshift:4.14::el9 cpe:/a:redhat:openshift:4.14::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 0:1.28.11-5.rhaos4.15.git35a2431.el8 < * cpe:/a:redhat:openshift:4.15::el8 cpe:/a:redhat:openshift:4.15::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202503060734.p0.gbc0b789.assembly.stream.el8 < * cpe:/a:redhat:openshift:4.15::el8 cpe:/a:redhat:openshift:4.15::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:1.29.9-6.rhaos4.16.gite7bd45a.el8 < * cpe:/a:redhat:openshift_ironic:4.16::el9 cpe:/a:redhat:openshift:4.16::el9 cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 4:4.9.4-12.rhaos4.16.el8 < * cpe:/a:redhat:openshift:4.16::el9 cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: v4.16.0-202503121138.p0.g31c3c26.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 0:1.30.6-6.rhaos4.17.git6ac6e96.el8 < * cpe:/a:redhat:openshift:4.17::el9 cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 5:5.2.2-1.rhaos4.17.el9 < * cpe:/a:redhat:openshift:4.17::el9 cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: v4.17.0-202501281204.p0.ga753153.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.17::el9
Red Hat	OpenShift Developer Tools and Services	cpe:/a:redhat:ocp_tools
Red Hat	OpenShift Developer Tools and Services	cpe:/a:redhat:ocp_tools
Red Hat	OpenShift Developer Tools and Services	cpe:/a:redhat:ocp_tools
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat Quay 3	cpe:/a:redhat:quay:3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9676",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T15:45:48.644647Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T15:46:17.963Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/containers/storage/",
          "defaultStatus": "unaffected",
          "packageName": "containers/storage",
          "versions": [
            {
              "lessThan": "1.55.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020241101101019.afee755d",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:4.9.4-16.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:5.2.2-9.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.37.5-1.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.33.11-1.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.12::el8",
            "cpe:/a:redhat:openshift_ironic:4.12::el9",
            "cpe:/a:redhat:openshift:4.12::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "cri-o",
          "product": "Red Hat OpenShift Container Platform 4.12",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.25.5-30.rhaos4.12.git53dc492.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "cri-o",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.26.5-26.rhaos4.13.giteb3d487.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9",
            "cpe:/a:redhat:openshift:4.14::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "cri-o",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.27.8-12.rhaos4.14.git7597c43.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9",
            "cpe:/a:redhat:openshift:4.14::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-docker-builder",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.14.0-202503060906.p0.gb03f3f5.assembly.stream.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el8",
            "cpe:/a:redhat:openshift:4.15::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "cri-o",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.28.11-5.rhaos4.15.git35a2431.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el8",
            "cpe:/a:redhat:openshift:4.15::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-docker-builder",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202503060734.p0.gbc0b789.assembly.stream.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_ironic:4.16::el9",
            "cpe:/a:redhat:openshift:4.16::el9",
            "cpe:/a:redhat:openshift:4.16::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "cri-o",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.29.9-6.rhaos4.16.gite7bd45a.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9",
            "cpe:/a:redhat:openshift:4.16::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:4.9.4-12.rhaos4.16.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-docker-builder-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.16.0-202503121138.p0.g31c3c26.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9",
            "cpe:/a:redhat:openshift:4.17::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "cri-o",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.30.6-6.rhaos4.17.git6ac6e96.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9",
            "cpe:/a:redhat:openshift:4.17::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "5:5.2.2-1.rhaos4.17.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-docker-builder-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.17.0-202501281204.p0.ga753153.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ocp_tools"
          ],
          "defaultStatus": "affected",
          "packageName": "jenkins-agent-base-rhel9-container",
          "product": "OpenShift Developer Tools and Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ocp_tools"
          ],
          "defaultStatus": "affected",
          "packageName": "ocp-tools-4/jenkins-agent-base-rhel8",
          "product": "OpenShift Developer Tools and Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ocp_tools"
          ],
          "defaultStatus": "affected",
          "packageName": "ocp-tools-4/jenkins-rhel8",
          "product": "OpenShift Developer Tools and Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "skopeo",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "conmon",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "skopeo",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "conmon",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "skopeo",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:quay:3"
          ],
          "defaultStatus": "affected",
          "packageName": "quay/quay-builder-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Erik Sj\u00f6lund (Upstream) for reporting this issue."
        }
      ],
      "datePublic": "2024-10-15T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-06T05:18:19.661Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:10289",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:10289"
        },
        {
          "name": "RHSA-2024:8418",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8418"
        },
        {
          "name": "RHSA-2024:8428",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8428"
        },
        {
          "name": "RHSA-2024:8437",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8437"
        },
        {
          "name": "RHSA-2024:8686",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8686"
        },
        {
          "name": "RHSA-2024:8690",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8690"
        },
        {
          "name": "RHSA-2024:8694",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8694"
        },
        {
          "name": "RHSA-2024:8700",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8700"
        },
        {
          "name": "RHSA-2024:8984",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8984"
        },
        {
          "name": "RHSA-2024:9051",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9051"
        },
        {
          "name": "RHSA-2024:9454",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9454"
        },
        {
          "name": "RHSA-2024:9459",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9459"
        },
        {
          "name": "RHSA-2024:9926",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9926"
        },
        {
          "name": "RHSA-2025:0876",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:0876"
        },
        {
          "name": "RHSA-2025:2454",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2454"
        },
        {
          "name": "RHSA-2025:2710",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2710"
        },
        {
          "name": "RHSA-2025:3301",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:3301"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-9676"
        },
        {
          "name": "RHBZ#2317467",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317467"
        },
        {
          "url": "https://github.com/advisories/GHSA-wq2p-5pc6-wpgf"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-10-09T02:59:07.708000+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-10-15T15:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_redhatCweChain": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-9676",
    "datePublished": "2024-10-15T15:27:33.665Z",
    "dateReserved": "2024-10-09T03:02:48.802Z",
    "dateUpdated": "2025-08-06T05:18:19.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9407 (GCVE-0-2024-9407)

Vulnerability from cvelistv5

Published

2024-10-01 20:13

Modified

2025-08-03 08:47

Severity ?

4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-20 - Improper Input Validation

Summary

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

References

►

URL

Tags

	https://access.redhat.com/errata/RHSA-2024:10147	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8846	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9051	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9454	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9459	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9926	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2024-9407	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2315887	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

►

Version: 0 ≤

		Version: 0 ≤
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020241023085649.afee755d < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 4:4.9.4-16.el9_4 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 4:5.2.2-9.el9_5 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.37.5-1.el9_5 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 2:1.33.11-1.el9_4 < * cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 416.94.202411201433-0 < * cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9407",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-01T20:38:18.374514Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-01T20:38:33.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-12-20T13:06:46.310Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241220-0010/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/containers/podman",
          "defaultStatus": "unaffected",
          "packageName": "podman",
          "versions": [
            {
              "lessThan": "5.2.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com/containers/buildah",
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "versions": [
            {
              "lessThan": "1.37.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020241023085649.afee755d",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:4.9.4-16.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:5.2.2-9.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.37.5-1.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.33.11-1.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "416.94.202411201433-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-docker-builder",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Erik Sj\u00f6lund (Upstream) for reporting this issue."
        }
      ],
      "datePublic": "2024-10-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-03T08:47:42.103Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:10147",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:10147"
        },
        {
          "name": "RHSA-2024:8846",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8846"
        },
        {
          "name": "RHSA-2024:9051",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9051"
        },
        {
          "name": "RHSA-2024:9454",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9454"
        },
        {
          "name": "RHSA-2024:9459",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9459"
        },
        {
          "name": "RHSA-2024:9926",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9926"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-9407"
        },
        {
          "name": "RHBZ#2315887",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315887"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-10-01T10:33:54.248000+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-10-01T00:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_redhatCweChain": "CWE-20: Improper Input Validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-9407",
    "datePublished": "2024-10-01T20:13:29.588Z",
    "dateReserved": "2024-10-01T10:55:34.838Z",
    "dateUpdated": "2025-08-03T08:47:42.103Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-11218 (GCVE-0-2024-11218)

Vulnerability from cvelistv5

Published

2025-01-22 04:55

Modified

2025-08-06 04:53

Severity ?

8.6 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-269 - Improper Privilege Management

Summary

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.

References

►

URL

Tags

	https://access.redhat.com/errata/RHSA-2025:0830	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:0878	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:0922	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:0923	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1186	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1187	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1188	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1189	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1207	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1275	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1295	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1296	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1372	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1453	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1707	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1713	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1908	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1910	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1914	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2441	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2443	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2454	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2456	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2701	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2703	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2710	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2712	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:3577	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:3798	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2024-11218	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2326231	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

►

Version: 0   ≤
Version: 1.35.0   ≤
Version: 1.37.0   ≤
Version: 1.38.0   ≤

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020250124120243.afee755d < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 8060020250203202123.3b538bd8 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 8060020250203202123.3b538bd8 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 8060020250203202123.3b538bd8 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 8080020250207173112.0f77c1b7 < * cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 4:5.2.2-13.el9_5 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.37.6-1.el9_5 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 2:4.2.0-6.el9_0 < * cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 1:1.26.9-1.el9_0 < * cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 1:1.29.5-1.el9_2 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 2:4.4.1-22.el9_2 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 2:1.33.12-2.el9_4 < * cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 4:4.9.4-17.el9_4 < * cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 412.86.202503052321-0 < * cpe:/a:redhat:openshift:4.12::el8 cpe:/a:redhat:openshift:4.12::el9
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 3:4.4.1-9.rhaos4.12.el8 < * cpe:/a:redhat:openshift:4.12::el8 cpe:/a:redhat:openshift:4.12::el9
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 1:1.29.5-1.rhaos4.13.el9 < * cpe:/a:redhat:openshift:4.13::el9 cpe:/a:redhat:openshift:4.13::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 3:4.4.1-16.rhaos4.13.el8 < * cpe:/a:redhat:openshift:4.13::el9 cpe:/a:redhat:openshift:4.13::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 413.92.202503112237-0 < * cpe:/a:redhat:openshift:4.13::el9 cpe:/a:redhat:openshift:4.13::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 3:4.4.1-22.rhaos4.14.el9 < * cpe:/a:redhat:openshift:4.14::el9 cpe:/a:redhat:openshift:4.14::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 1:1.29.5-1.rhaos4.14.el9 < * cpe:/a:redhat:openshift:4.14::el9 cpe:/a:redhat:openshift:4.14::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 414.92.202503100617-0 < * cpe:/a:redhat:openshift:4.14::el9 cpe:/a:redhat:openshift:4.14::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 3:4.4.1-33.rhaos4.15.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 1:1.29.5-1.rhaos4.15.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 415.92.202503060749-0 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 4:4.9.4-15.rhaos4.16.el9 < * cpe:/a:redhat:openshift:4.16::el8 cpe:/a:redhat:openshift_ironic:4.16::el9 cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 2:1.33.12-1.rhaos4.16.el9 < * cpe:/a:redhat:openshift:4.16::el8 cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 416.94.202502180249-0 < * cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 5:5.2.2-2.rhaos4.17.el9 < * cpe:/a:redhat:openshift:4.17::el9 cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 2:1.33.12-1.rhaos4.17.el8 < * cpe:/a:redhat:openshift:4.17::el9 cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202504080421-0 < * cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 2:1.33.12-1.rhaos4.18.el9 < * cpe:/a:redhat:openshift:4.18::el9 cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 418.94.202504021150-0 < * cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11218",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-22T14:11:18.056703Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T17:08:25.061Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/containers/buildah",
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "versions": [
            {
              "lessThan": "1.33.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.35.5",
              "status": "affected",
              "version": "1.35.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.37.6",
              "status": "affected",
              "version": "1.37.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.38.1",
              "status": "affected",
              "version": "1.38.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020250124120243.afee755d",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/a:redhat:rhel_aus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020250203202123.3b538bd8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/a:redhat:rhel_aus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020250203202123.3b538bd8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/a:redhat:rhel_aus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020250203202123.3b538bd8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020250207173112.0f77c1b7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:5.2.2-13.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.37.6-1.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:4.2.0-6.el9_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.26.9-1.el9_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.29.5-1.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:4.4.1-22.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.33.12-2.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:4.9.4-17.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.12::el8",
            "cpe:/a:redhat:openshift:4.12::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.12",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "412.86.202503052321-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.12::el8",
            "cpe:/a:redhat:openshift:4.12::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.12",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-9.rhaos4.12.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.29.5-1.rhaos4.13.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-16.rhaos4.13.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "413.92.202503112237-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9",
            "cpe:/a:redhat:openshift:4.14::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-22.rhaos4.14.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9",
            "cpe:/a:redhat:openshift:4.14::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.29.5-1.rhaos4.14.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9",
            "cpe:/a:redhat:openshift:4.14::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "414.92.202503100617-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-33.rhaos4.15.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.29.5-1.rhaos4.15.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "415.92.202503060749-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el8",
            "cpe:/a:redhat:openshift_ironic:4.16::el9",
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:4.9.4-15.rhaos4.16.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el8",
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.33.12-1.rhaos4.16.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "416.94.202502180249-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9",
            "cpe:/a:redhat:openshift:4.17::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "5:5.2.2-2.rhaos4.17.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9",
            "cpe:/a:redhat:openshift:4.17::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.33.12-1.rhaos4.17.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "417.94.202504080421-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9",
            "cpe:/a:redhat:openshift:4.18::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.33.12-1.rhaos4.18.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "418.94.202504021150-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-01-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-06T04:53:58.659Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2025:0830",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:0830"
        },
        {
          "name": "RHSA-2025:0878",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:0878"
        },
        {
          "name": "RHSA-2025:0922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:0922"
        },
        {
          "name": "RHSA-2025:0923",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:0923"
        },
        {
          "name": "RHSA-2025:1186",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1186"
        },
        {
          "name": "RHSA-2025:1187",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1187"
        },
        {
          "name": "RHSA-2025:1188",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1188"
        },
        {
          "name": "RHSA-2025:1189",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1189"
        },
        {
          "name": "RHSA-2025:1207",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1207"
        },
        {
          "name": "RHSA-2025:1275",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1275"
        },
        {
          "name": "RHSA-2025:1295",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1295"
        },
        {
          "name": "RHSA-2025:1296",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1296"
        },
        {
          "name": "RHSA-2025:1372",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1372"
        },
        {
          "name": "RHSA-2025:1453",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1453"
        },
        {
          "name": "RHSA-2025:1707",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1707"
        },
        {
          "name": "RHSA-2025:1713",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1713"
        },
        {
          "name": "RHSA-2025:1908",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1908"
        },
        {
          "name": "RHSA-2025:1910",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1910"
        },
        {
          "name": "RHSA-2025:1914",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1914"
        },
        {
          "name": "RHSA-2025:2441",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2441"
        },
        {
          "name": "RHSA-2025:2443",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2443"
        },
        {
          "name": "RHSA-2025:2454",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2454"
        },
        {
          "name": "RHSA-2025:2456",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2456"
        },
        {
          "name": "RHSA-2025:2701",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2701"
        },
        {
          "name": "RHSA-2025:2703",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2703"
        },
        {
          "name": "RHSA-2025:2710",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2710"
        },
        {
          "name": "RHSA-2025:2712",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2712"
        },
        {
          "name": "RHSA-2025:3577",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:3577"
        },
        {
          "name": "RHSA-2025:3798",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:3798"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-11218"
        },
        {
          "name": "RHBZ#2326231",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2326231"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-11-14T13:05:29.849000+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-01-20T00:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mandatory access controls should limit the access of the process performing the build, on systems where they are enabled.\n\nSELinux enforces strict access controls by confining the build process (e.g., Podman) to specific domains like container_t. This prevents unauthorized access to sensitive host files and directories, even if a malicious Containerfile tries to exploit the --mount flag."
        }
      ],
      "x_redhatCweChain": "CWE-269: Improper Privilege Management"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-11218",
    "datePublished": "2025-01-22T04:55:30.649Z",
    "dateReserved": "2024-11-14T13:11:49.476Z",
    "dateUpdated": "2025-08-06T04:53:58.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

suse-su-2025:0267-1

Vulnerability from csaf_suse

CVE-2024-1753 (GCVE-0-2024-1753)

Vulnerability from cvelistv5

CVE-2024-9341 (GCVE-0-2024-9341)

Vulnerability from cvelistv5

CVE-2024-9675 (GCVE-0-2024-9675)

Vulnerability from cvelistv5

CVE-2024-9676 (GCVE-0-2024-9676)

Vulnerability from cvelistv5

CVE-2024-9407 (GCVE-0-2024-9407)

Vulnerability from cvelistv5

CVE-2024-11218 (GCVE-0-2024-11218)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature