csaf_suse - suse-su-2025:20279-1

suse-su-2025:20279-1

Vulnerability from csaf_suse

Published

2025-04-22 13:50

Modified

2025-04-22 13:50

Summary

Security update for podman

Notes

Title of the patch

Security update for podman

Description of the patch

This update for podman fixes the following issues: - CVE-2023-45288: Fixed closing connection when receiving too many headers (bsc#1236507). - CVE-2024-11218: Fixed container breakout by using --jobs=2 and a race condition when building a malicious Containerfile (bsc#1236270). - CVE-2025-22869: Fixed Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239330). - CVE-2025-27144: Fixed Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237641). - CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (bsc#1231208). - CVE-2024-3727: Fixed digest type (bsc#1224112). - CVE-2024-1753: Fixed full container escape at build time (bsc#1221677). Other fixes: - Updated to version 5.2.5: * RPM: remove dup Provides * Packit: constrain koji and bodhi jobs to fedora package to avoid dupes * Validate the bind-propagation option to `--mount` * Updated Buildah to v1.37.4 * vendor: updated c/common to v0.60.4 * pkg/specgen: allow pasta when running inside userns * libpod: convert owner IDs only with :idmap * allow exposed sctp ports * libpod: setupNetNS() correctly mount netns * vendor: updated c/common to v0.60.3 * [skip-ci] Packit: split out ELN jobs and reuse fedora downstream targets * [skip-ci] Packit: Enable sidetags for bodhi updates * Updated gvisor-tap-vsock to 0.7.5 * CI: podman-machine: do not use cache registry * [CI:DOCS] Add v5.2.2 lib updates to RELEASE_NOTES.md * Update RELEASE_NOTES for v5.2.2 * [v5.2] Bump Buildah to v1.37.2, c/common v0.60.2, c/image v5.32.2 * [v5.2] golangci-lint: make darwin linting happy * [v5.2] golangci-lint: make windows linting happy * [v5.2] test/e2e: remove kernel version check * [v5.2] golangci-lint: remove most skip dirs * [v5.2] set !remote build tags where needed * [v5.2] update golangci-lint to 1.60.1 * Packit: update targets for propose-downstream * Create volume path before state initialization * Update Cirrus DEST_BRANCH * Bump to v5.2.2-dev * Bump to v5.2.1 * Update release notes for v5.2.1 * [v5.2] Add zstd:chunked test fix * [v5.2] Bump Buildah to v1.37.1, c/common v0.60.1, c/image v5.32.1 * libpod: reset state error on init * libpod: do not save expected stop errors in ctr state * libpod: fix broken saveContainerError() * Bump to v5.2.1-dev * Bump to v5.2.0 * Never skip checkout step in release workflow * Bump to v5.2.0-dev * Bump to v5.2.0-rc3 * Update release notes for v5.2.0-rc3 * Tweak versions in register_images.go * fix network cleanup flake in play kube * WIP: Fixes for vendoring Buildah * Add --compat-volumes option to build and farm build * Bump Buildah, c/storage, c/image, c/common * libpod: bind ports before network setup * pkg/api: do not leak config pointers into specgen * build: Update gvisor-tap-vsock to 0.7.4 * test/system: fix borken pasta interface name checks * test/system: fix bridge host.containers.internal test * CI: system tests: instrument to allow failure analysis * Use uploaded .zip for Windows action * RPM: podman-iptables.conf only on Fedora * Bump to v5.2.0-dev * Bump to v5.2.0-rc2 * Update release notes for v5.2.0-rc2 * test/e2e: fix ncat tests * libpod: add hidden env to set sqlite timeout * Add support for StopSignal in quadlet .container files * podman pod stats: fix race when ctr process exits * Update module github.com/vbauerster/mpb/v8 to v8.7.4 * libpod: correctly capture healthcheck output * Bump bundled krunkit to 0.1.2 * podman stats: fix race when ctr process exists * nc -p considered harmful * podman pod stats: fix pod rm race * podman ps: fix racy pod name query * system connection remove: use Args function to validate * pkg/machine/compression: skip decompress bar for empty file * nc -p considered harmful * podman system df: fix fix ErrNoSuchCtr/Volume race * podman auto-update: fix ErrNoSuchCtr race * Fix name for builder in farm connection * 700-play.bats: use unique pod/container/image/volume names * safename: consistent within same test, and, dashes * 700-kube.bats: refactor $PODMAN_TMPDIR/test.yaml * 700-play.bats: eliminate $testYaml * 700-play.bats: refactor clumsy yamlfile creation * 700-play.bats: move _write_test_yaml up near top * chore(deps): update dependency setuptools to v71 * Expand drop-in search paths * top-level (pod.d) * truncated (unit-.container.d) * Remove references and checks for --gpus * Do not crash on invalid filters * fix(deps): update module github.com/rootless-containers/rootlesskit/v2 to v2.2.0 * Bump to v5.2.0-dev * Bump to v5.2.0-rc1 * Keep the volume-driver flag deprecated * Vendor in latest containers(common, storage,image, buildah) * System tests: safe container/image/volume/etc names * Implement disable default mounts via command line * test: drop unmount for overlay * test: gracefully terminate server * libpod: shutdown Stop waits for handlers completion * libpod: cleanup store at shutdown * Add NetworkAlias= support to quadlet * cmd: call shutdown handler stop function * fix race conditions in start/attach logic * swagger: exlude new docker network types * vendor: bump c/storage * update to docker 27 * contrib: use a distinct --pull-option= for each flag * Update warning message when using external compose provider * Update module github.com/cyphar/filepath-securejoin to v0.3.0 * Ignore result of EvalSymlinks on ENOENT * test/upgrade: fix tests when netavark uses nftables * test/system: fix network reload test with nftables * test/e2e: rework some --expose tests * test: remove publish tests from e2e * CI: test nftables driver on fedora * CI: use local registry, part 3 of 3: for developers * CI: use local registry, part 2 of 3: fix tests * CI: use local registry, part 1 of 3: setup * CI: test composefs on rawhide * chore(deps): update module google.golang.org/grpc to v1.64.1 [security] * chore(deps): update dependency setuptools to ~=70.3.0 * Improve container filenname ambiguity. * containers/attach: Note bug around goroutine leak * Drop minikube CI test * add libkrun test docs * fix(deps): update module tags.cncf.io/container-device-interface to v0.8.0 * cirrus: check for header files in source code check * pkg/machine/e2e: run debug command only for macos * create runtime's worker queue before queuing any job * test/system: fix pasta host.containers.internal test * Visual Studio BuildTools as a MinGW alternative * SetupRootless(): only reexec when needed * pkg/rootless: simplify reexec for container code * cirrus: add missing test/tools to danger files * fix(deps): update module golang.org/x/tools to v0.23.0 * Windows Installer: switch to wix5 * fix(deps): update module golang.org/x/net to v0.27.0 * pkg/machine/e2e: print tests timings at the end * pkg/machine/e2e: run debug commands after init * pkg/machine/e2e: improve timeout handling * libpod: first delete container then cidfile * fix(deps): update module golang.org/x/term to v0.22.0 * System test fixes * cirrus.yml: automatic skips based on source * fix(deps): update module github.com/containers/ocicrypt to v1.2.0 * podman events: fix error race * chore(deps): update dependency setuptools to ~=70.2.0 * fix(deps): update module github.com/gorilla/schema to v1.4.1 [security] * Update CI VM images * pkg/machine/e2e: fix broken cleanup * pkg/machine/e2e: use tmp file for connections * test/system: fix podman --image-volume to allow tmpfs storage * CI: mount tmpfs for container storage * docs: --network remove missing leading sentence * specgen: parse devices even with privileged set * vendor: update c/storage * Remove the unused machine volume-driver * feat(quadlet): log option handling * Error when machine memory exceeds system memory * machine: Always use --log-file with gvproxy * CI: Build-Each-Commit test: run only on PRs * Small fixes for testing libkrun * Podman machine resets all providers * Clearly indicate names w/ URLencoded duplicates * [skip-ci] Packit: split rhel and centos-stream jobs * apple virtiofs: fix racy mount setup * cirrus: fix broken macos artifacts URL * libpod/container_top_linux.c: fix missing header * refactor(build): improve err when file specified by -f does not exist * Minor: Remove unhelpful comment * Update module github.com/openshift/imagebuilder to v1.2.11 * Minor: Rename the OSX Cross task * [skip-ci] Remove conditionals from changelog * podman top: join the container userns * Run linting in parallel with building * Fix missing Makefile target dependency * build API: accept platform comma separated * [skip-ci] RPM: create podman-machine subpackage * ExitWithError() - more upgrades from Exit() * test/e2e: remove podman system service tests * cirrus: reduce int tests timeout * cirrus: remove redundant skip logic * pkg/machine/apple: machine stop timeout * CI: logformatter: link to correct PR base * Update module github.com/crc-org/crc/v2 to v2.38.0 * ExitWithError(): continued * test/system: Add test steps for journald log check in quadlet * restore: fix missing network setup * podman run use pod userns even with --pod-id-file * macos-installer: bundle krunkit * remote API: fix pod top error reporting * libpod API: return proper error status code for pod start * fix #22233 * added check for `registry.IsRemote()`. and correct error message. * fix #20686 * pkg/machine/e2e: Remove unnecessary copy of machine image. * libpod: intermediate mount if UID not mapped into the userns * libpod: avoid chowning the rundir to root in the userns * libpod: do not chmod bind mounts * libpod: unlock the thread if possible * CI Cleanup: Remove cgroups v1 support * ExitWithError() - more upgrades from Exit() * remote: fix incorrect CONTAINER_CONNECTION parsing * container: pass KillSignal and StopTimeout to the systemd scope * libpod: fix comment * e2e: test container restore in pod by name * docs: Adds all PushImage supported paramters to openapi docs. * systests: kube: bump up a timeout * cirrus.yml: add CI:ALL mode to force all tests * cirrus.yml: implement skips based on source changes * CI VMs: bump * restore: fix container restore into pod * sqlite_state: Fix RewriteVolumeConfig * chore(deps): update dependency setuptools to ~=70.1.0 * Quadlet - use specifier for unescaped values for templated container name * cirrus: check for system test leaks in nightly * test/system: check for leaks in teardown suite * test/system: speed up basic_{setup,teardown}() * test/system: fix up many tests that do not cleanup * test/system: fix podman --authfile=nonexistent-path * Update module github.com/containernetworking/plugins to v1.5.1 * Update module github.com/checkpoint-restore/checkpointctl to v1.2.1 * Update module github.com/spf13/cobra to v1.8.1 * Update module github.com/gorilla/schema to v1.4.0 * pkg/machine/wsl: force terminate wsl instance * pkg/machine/wsl: wrap command errors * [CI:DOCS] Quadlet - add note about relative path resolution * CI: do not install python packages at runtime * Release workflow: Include candidate descriptor * Minor: Fix indentation in GHA release workflow * GHA: Send release notification mail * GHA: Validate release version number * Remove references to --pull=true and --pull=false * ExitWithError, continued * podman: add new hidden flag --pull-option * [CI:DOCS] Fix typos in podman-build * infra: mark storageSet when imagestore is changed * [CI:DOCS] Add jnovy as reviewer and approver * fix(deps): update module google.golang.org/protobuf to v1.34.2 * refactor(machine,wsl): improve operations of Windows API * --squash --layers=false should be allowed * fix(deps): update module github.com/checkpoint-restore/checkpointctl to v1.2.0 * update golangci-lint to v1.59.1 * Rename master to main in CONTRIBUTING.md * podman 5, pasta and inter-container networking * libpod: do not resuse networking on start * machine/linux: Switch to virtiofs by default * machine/linux: Support virtiofs mounts (retain 9p default) * machine/linux: Use memory-backend-memfd by default * ExitWithError() - continued * Enable libkrun provider to open a debug console * Add new targets on Windows makefile (winmake.ps1) * fix(deps): update module github.com/docker/docker to v26.1.4+incompatible * fix(deps): update module github.com/crc-org/crc/v2 to v2.37.1 * fix(deps): update module golang.org/x/tools to v0.22.0 * fix(deps): update module golang.org/x/net to v0.26.0 * libpod: fix 'podman kube generate' on FreeBSD * fix(deps): update module golang.org/x/sys to v0.21.0 * libpod: do not leak systemd hc startup unit timer * vendor latest c/common * pkg/rootless: set _CONTAINERS_USERNS_CONFIGURED correctly * run bats -T, to profile timing hogs * test/system: speed up podman ps --external * test/system: speed up podman network connect/disconnect * test/system: speed up podman network reload * test/system: speed up quadlet - pod simple * test/system: speed up podman parallel build should not race * test/system: speed up podman cp dir from host to container * test/system: speed up podman build - workdir, cmd, env, label * test/system: speed up podman --log-level recognizes log levels * test/system: remove obsolete debug in net connect/disconnect test * test/system: speed up quadlet - basic * test/system: speed up user namespace preserved root ownership * System tests: add `podman system check` tests * Add `podman system check` for checking storage consistency * fix(deps): update module github.com/crc-org/crc/v2 to v2.37.0 * fix(libpod): add newline character to the end of container's hostname file * fix(deps): update module github.com/openshift/imagebuilder to v1.2.10 * fix(deps): update github.com/containers/image/v5 digest to aa93504 * Fix 5.1 release note re: runlabel * test/e2e: use local skopeo not image * fix(deps): update golang.org/x/exp digest to fd00a4e * [CI:DOCS] Add contrib/podmanimage/stable path back in repo * chore(deps): update dependency requests to ~=2.32.3 * fix(deps): update github.com/containers/image/v5 digest to 2343e81 * libpod: do not move podman with --cgroups=disabled * Update release notes on Main to v5.1.0 * test: look at the file base name * tests: simplify expected output * Sigh, new VMs again * Fail earlier when no containers exist in stats * Add Hyper-V option in windows installer * libpod: cleanup default cache on system reset * vendor: update c/image * test/system: speed up kube generate tmpfs on /tmp * test/system: speed up podman kube play tests * test/system: speed up podman shell completion test * test/system: simplify test signal handling in containers * test/system: speed up podman container rm ... * test/system: speed up podman ps - basic tests * test/system: speed up read-only from containers.conf * test/system: speed up podman logs - multi ... * test/system: speed up podman run --name * Debian: switch to crun * test/system: speed up podman generate systemd - envar * test/system: speed up podman-kube@.service template * test/system: speed up kube play healthcheck initialDelaySeconds * test/system: speed up exit-code propagation test * test/system: speed up "podman run --timeout" * test/system: fix slow kube play --wait with siginterrupt * undo auto-formatting * test/system: speed up podman events tests * Quadlet: Add support for .build files * test/system: speed up "podman auto-update using systemd" * test/system: remove podman wait test * tests: disable tests affected by a race condition * update golangci-lint to v1.59.0 * kubernetes_support.md: Mark volumeMounts.subPath as supported * working name of pod on start and stop * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.19.0 * Bump Buildah to v1.36.0 * fix(deps): update module github.com/burntsushi/toml to v1.4.0 * fix typo in Tutorials.rst * Mac PM test: Require pre-installed rosetta * test/e2e: fix new error message * Add configuration for podmansh * Update containers/common to latest main * Only stop chowning volumes once they're not empty * podman: fix --sdnotify=healthy with --rm * libpod: wait another interval for healthcheck * quadlet: Add a network requirement on .image units * test, pasta: Ignore deprecated addresses in tests * [CI:DOCS] performance: update network docs * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.18.0 * CI: disable minikube task * [CI:DOCS] Fix windows action trigger * chore(deps): update dependency setuptools to v70 * Check AppleHypervisor before accessing it * fix(deps): update module github.com/containernetworking/plugins to v1.5.0 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.58.2 * add podman-clean-transient.service service to rootless * [CI:DOCS] Update podman network docs * fix incorrect host.containers.internal entry for rootless bridge mode * vendor latest c/common main * Add Rosetta support for Apple Silicon mac * bump main to 5.2.0-dev * Use a defined constant instead of a hard-coded magic value * cirrus: use faster VM's for integration tests * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 01a1a0c * [CI:DOCS] Fix Mac pkg link * test: remove test_podman* scripts * test/system: fix documentation * Return StatusNotFound when multiple volumes matching occurs * container_api: do not wait for healtchecks if stopped * libpod: wait for healthy on main thread * `podman events`: check for an error after we finish reading events * remote API: restore v4 payload in container inspect * Fix updating connection when SSH port conflict happens * rootless: fix reexec to use /proc/self/exe * ExitWithError() - enforce required exit status & stderr * ExitWithError() - a few that I missed * [skip-ci] Packit: use only one value for `packages` key for `trigger: commit` copr builds * Revert "Temporarily disable rootless debian e2e testing" * CI tests: enforce TMPDIR on tmpfs * use new CI images with tmpfs /tmp * run e2e test on tmpfs * Update module github.com/crc-org/crc/v2 to v2.36.0 * [CI:DOCS] Use checkout@v4 in GH Actions * ExitWithError() - rmi_test * ExitWithError() - more r files * ExitWithError() - s files * ExitWithError() - more run_xxx tests * Fix podman-remote support for `podman farm build` * [CI:DOCS] Trigger windows installer action properly * Revert "container stop: kill conmon" * Ensure that containers do not get stuck in stopping * [CI:DOCS] Improvements to make validatepr * ExitWithError() - rest of the p files * [CI:DOCS] Update dependency golangci/golangci-lint to v1.58.1 * Graceful shutdown during podman kube down * Remove duplicate call * test/system: fix broken "podman volume globs" test * Quadlet/Container: Add GroupAdd option * Don't panic if a runtime was configured without paths * update c/{buildah,common,image,storage} to latest main * update golangci-lint to 1.58 * machine: Add LibKrun provider detection * ExitWithError() - continue tightening * fix(deps): update module google.golang.org/protobuf to v1.34.1 * test: improve test for powercap presence * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.17.3 * fix(deps): update module go.etcd.io/bbolt to v1.3.10 * fix(deps): update module golang.org/x/tools to v0.21.0 * [skip-ci] RPM: `bats` required only on Fedora * fix(deps): update module golang.org/x/exp to v0.0.0-20240506185415-9bf2ced13842 * gpdate and remove parameter settings in `.golangci.yml` * ExitWithError() - play_kube_test.go * Temporarily disable rootless debian e2e testing * fix(deps): update module golang.org/x/crypto to v0.23.0 * CI Docs: Clarify passthrough_envars() comments * Skip machine tests if they don't need to be run * Update CI VMs to F40, F39, D13 * ExitWithError() - v files * Update module golang.org/x/term to v0.20.0 * machine: Add provider detection API * util: specify a not empty pause dir for root too * Add missing option 'healthy' to output of `podman run --help` * [CI:DOCS] Add info on the quay.io images to the README.md * Add a random suffix to healthcheck unit names * test/e2e: remove toolbox image * Also substitute $HOME in runlabel with user's homedir * Update module github.com/cyphar/filepath-securejoin to v0.2.5 * Change tmpDir for macOS * ExitWithError() - pod_xxx tests * ExitWithError() -- run_test.go * Update module golang.org/x/exp to v0.0.0-20240416160154-fe59bbe5cc7f * Update module github.com/shirou/gopsutil/v3 to v3.24.4 * Update module github.com/docker/docker to v26.1.1+incompatible * GHA: Attempt fix exceeded a secondary rate limit * vendor ginkgo 2.17.2 into test/tools * Fix machine volumes with long path and paths with dashes * Update module google.golang.org/protobuf to v1.34.0 * Update module github.com/crc-org/crc/v2 to v2.35.0 * Update module github.com/onsi/gomega to v1.33.1 * test/e2e: podman unshare image mount fix tmpdir leak * test/e2e: do not leak /tmp/private_file * test/e2e: "persistentVolumeClaim with source" do not leak file * e2e tests: use /var/tmp, not $TMPDIR, as workdirs * Update dependency pytest to v8.1.2 * Remove unncessary lines at the end of specfile summary * Clean machine pull cache * Add krun support to podman machine * Use custom image for make validatepr * test/e2e: force systemd cgroup manager * e2e and bindings tests: fix $PATH setup * Makefile: remove useless HACK variable in e2e test * test/e2e: fix volumes and suid/dev/exec options * test/e2e: volumes and suid/dev/exec options works remote * test/e2e: fix limits test * Update module github.com/rootless-containers/rootlesskit/v2 to v2.1.0 * Correct option name `ip` -> `ip6` * Add the ability to automount images as volumes via play * Add support for image volume subpaths * Bump Buildah to latest main * Update Makefile to Go 1.22 for in-container * ExitWithError() - yet more low-hanging fruit * ExitWithError() - more low-hanging fruit * ExitWithError() - low-hanging fruit * chore: fix function names in comment * Remove redundant Prerequisite before build section * Remove PKG_CONFIG_PATH * Add installation instructions for openSUSE * Replace golang.org/x/exp/slices with slices from std * Update to go 1.21 * fix(deps): update module github.com/docker/docker to v26.1.0+incompatible * [CI:DOCS] Fix artifact action * [skip-ci] Packit/rpm: remove el8 jobs and spec conditionals * e2e tests: stop littering * [CI:DOCS] format podman-pull example as code * [CI:DOCS] Build & upload release artifacts with GitHub Actions * libpod: getHealthCheckLog() remove unessesary check * add containers.conf healthcheck_events support * vendor latest c/common * libpod: make healthcheck events more efficient * libpod: wrap store setup error message * [skip-ci] Packit: enable CentOS 10 Stream build jobs * pkg/systemd: use fileutils.(Le|E)xists * pkg/bindings: use fileutils.(Le|E)xists * pkg/util: use fileutils.(Le|E)xists * pkg/trust: use fileutils.(Le|E)xists * pkg/specgen: use fileutils.(Le|E)xists * pkg/rootless: use fileutils.(Le|E)xists * pkg/machine: use fileutils.(Le|E)xists * pkg/domain: use fileutils.(Le|E)xists * pkg/api: use fileutils.(Le|E)xists * libpod: use fileutils.(Le|E)xists * cmd: use fileutils.(Le|E)xists * vendor: update containers/{buildah,common,image,storage} * fix(deps): update module github.com/docker/docker to v26.0.2+incompatible [security] * fix podman-pod-restart.1.md typo * [skip-ci] Packit: switch to EPEL instead of centos-stream+epel-next * fix(deps): update module github.com/onsi/gomega to v1.33.0 * Add more annnotation information to podman kupe play man page * test/compose: remove compose v1 code * CI: remove compose v1 tests * fix: close resource file * [CI:DOCS] Fix windows installer action * fix(deps): update module tags.cncf.io/container-device-interface to v0.7.2 * add `list` as an alias to list networks * Add support for updating restart policy * Add Compat API for Update * Make `podman update` changes persistent * Emergency fix (well, skip) for failing bud tests * fix swagger doc for manifest create * [CI:DOCS] options/network: fix markdown lists * Makefile: do not hardcode `GOOS` in `podman-remote-static` target * chore(deps): update module golang.org/x/crypto to v0.17.0 [security] * chore(deps): update dependency setuptools to ~=69.5.0 * Fix some comments * swagger fix infinitive recursion on some types * install swagger from source * Revert "Swap out javascript engine" * podman exec CID without command should exit 125 * (minor) prefetch systemd image before use * Update go-swagger version * Swap out javascript engine * fix(deps): update module github.com/docker/docker to v26.0.1+incompatible * Add os, arch, and ismanifest to libpod image list * [CI:DOCS]Initial PR validation * fix(deps): update github.com/containers/gvisor-tap-vsock digest to d744d71 * vendor ginkgo 2.17.1 into test/tools * fix "concurrent map writes" in network ls compat endpoint * chore(deps): update dependency pytest to v8 * e2e: redefine ExitWithError() to require exit code * docs: fix missleading run/create --expose description * podman ps: show exposed ports under PORTS as well * rootless: drop function ReadMappingsProc * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.7.3 * New CI VMs, to give us pasta 2024-04-05 * Add big warning to GHA workflow * GHA: Fix intermittent workflow error * fix(deps): update module golang.org/x/tools to v0.20.0 * e2e tests: remove requirement for fuse-overlayfs * docs: update Quadlet volume Options desc * fix(deps): update module golang.org/x/sync to v0.7.0 * Fix relabeling failures with Z/z volumes on Mac * fix(deps): update module golang.org/x/net to v0.24.0 * Makefile: fix annoying errors in docs generation * chore: fix function names in comment * Bump tags.cncf.io/container-device-interface to v0.7.1 * fix(deps): update module golang.org/x/crypto to v0.22.0 * Detect unhandled reboots and require user intervention * podman --runroot: remove 50 char length restriction * update github.com/rootless-containers/rootlesskit to v2 * Update module github.com/gorilla/schema to v1.3.0 * Update dependency requests-mock to ~=1.12.1 * Update module github.com/crc-org/crc/v2 to v2.34.1 * rm --force work for more than one arg * [CI:DOCS] Update kube docs * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.24.3 * [CI:DOCS] Add GitHub action to update version on Podman.io * [CI:DOCS] Update dependency golangci/golangci-lint to v1.57.2 * Windows: clean up temporary perl install * pkg/util: FindDeviceNodes() ignore ENOENT errors * [CI:DOCS] build deps: make-validate needs docs * test/system: add rootless-netns test for setup errors * vendor latest c/common main * container: do not chown to dest target with U * [CI:DOCS] golangci-lint: update deprecated flags * systests: conditionalize slirp4netns tests * CI: systests: instrument flaky tests * s3fs docs * test: do not skip tests under rootless * Add note about host networking to Kube PublishPort option * Inject additional build tags from the environment * libpod: use original IDs if idmap is provided * Switch back to checking out the same branch the action script runs in * docs/podman-login: Give an example of writing the persistent path * CI: Bump VMs to 2024-03-28 * [skip-ci] Update dawidd6/action-send-mail action to v3.12.0 * fix(deps): update module github.com/openshift/imagebuilder to v1.2.7 * Fix reference to deprecated types.Info * Use logformatter for podman_machine_windows_task * applehv: Print vfkit logs in --log-level debug * [CI:DOCS]Add Mario to reviewers list * [CI:DOCS] Document CI-maintenance job addition * Add golang 1.21 update warning * Add rootless network command to `podman info` * libpod: don't warn about cgroupsv1 on FreeBSD * hyperv: error if not admin * Properly parse stderr when updating container status * [skip-ci] Packit: specify fedora-latest in propose-downstream * Use built-in ssh impl for all non-pty operations * Add support for annotations * hyperv: fix machine rm -r * [skip-ci] Packit: Enable CentOS Stream 10 update job * 5.0 release note fix typo in cgroupv1 env var * fix remote build isolation on client side * chore: remove repetitive words * Dont save remote context in temp file but stream and extract * fix remote build isolation when server runs as root * util: use private propagation with bind * util: add some tests for ProcessOptions * util: refactor ProcessOptions into an internal function * util: rename files to snake case * Add LoongArch support for libpod * fix(deps): update github.com/containers/common digest to bc5f97c * [CI:DOCS] Update dependency golangci/golangci-lint to v1.57.1 * fix(deps): update module github.com/docker/docker to v25.0.5+incompatible [security] * fix(deps): update module github.com/onsi/gomega to v1.32.0 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.57.0 * Update module github.com/cpuguy83/go-md2man/v2 to v2.0.4 * Fix type-o * Use correct extension in suite * minikube: instrument tests, to allow debugging failures * libpod: restart always reconfigure the netns * use new c/common pasta2 setup logic to fix dns * utils: drop conversion float->string->float * utils: do not generate duplicate range * logformatter: handle Windows logs * utils: add test for the new function * utils: move rootless code to a new function * xref-helpmsgs-manpages: cross-check Commands.rst * test/system: Add support for multipath routes in pasta networking tests * [skip-ci] rpm: use macro supported vendoring * Adjust to the standard location of gvforwarder used in new images * Makefile: add target `podman-remote-static` * Switch to 5.x WSL machine os stream using new automation * Cleanup build scratch dir if remote end disconnects while passing the context * bump main to 5.1.0-dev * Use faster gzip for compression for 3x speedup for sending large contexts to remote * pkg/machine: make checkExclusiveActiveVM race free * pkg/machine/wsl: remove unused CheckExclusiveActiveVM() * pkg/machine: CheckExclusiveActiveVM should also check for starting * pkg/machine: refresh config after we hold lock * Update dependency setuptools to ~=69.2.0 * [skip-ci] rpm: update containers-common dep on f40+ * fix invalid HTTP header values when hijacking a connection * Add doc to build podman on windows without MSYS * Removing CRI-O related annotations * fix(deps): update module github.com/containers/ocicrypt to v1.1.10 * Pass the restart policy to the individual containers * kube play: always pull when both imagePullPolicy and tag are missing

Patchnames

SUSE-SLE-Micro-6.1-76

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for podman",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for podman fixes the following issues:\n\n- CVE-2023-45288: Fixed closing connection when receiving too many headers (bsc#1236507).\n- CVE-2024-11218: Fixed container breakout by using --jobs=2 and a race condition when building a malicious Containerfile (bsc#1236270).\n- CVE-2025-22869: Fixed Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239330).\n- CVE-2025-27144: Fixed Go JOSE\u0027s Parsing Vulnerable to Denial of Service (bsc#1237641).\n- CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (bsc#1231208).\n- CVE-2024-3727: Fixed digest type (bsc#1224112).\n- CVE-2024-1753: Fixed full container escape at build time (bsc#1221677). \n\nOther fixes:\n- Updated to version 5.2.5:\n  * RPM: remove dup Provides\n  * Packit: constrain koji and bodhi jobs to fedora package to avoid dupes\n  * Validate the bind-propagation option to `--mount`\n  * Updated Buildah to v1.37.4\n  * vendor: updated c/common to v0.60.4\n  * pkg/specgen: allow pasta when running inside userns\n  * libpod: convert owner IDs only with :idmap\n  * allow exposed sctp ports\n  * libpod: setupNetNS() correctly mount netns\n  * vendor: updated c/common to v0.60.3\n  * [skip-ci] Packit: split out ELN jobs and reuse fedora downstream targets\n  * [skip-ci] Packit: Enable sidetags for bodhi updates\n  * Updated gvisor-tap-vsock to 0.7.5\n  * CI: podman-machine: do not use cache registry\n  * [CI:DOCS] Add v5.2.2 lib updates to RELEASE_NOTES.md\n  * Update RELEASE_NOTES for v5.2.2\n  * [v5.2] Bump Buildah to v1.37.2, c/common v0.60.2, c/image v5.32.2\n  * [v5.2] golangci-lint: make darwin linting happy\n  * [v5.2] golangci-lint: make windows linting happy\n  * [v5.2] test/e2e: remove kernel version check\n  * [v5.2] golangci-lint: remove most skip dirs\n  * [v5.2] set !remote build tags where needed\n  * [v5.2] update golangci-lint to 1.60.1\n  * Packit: update targets for propose-downstream\n  * Create volume path before state initialization\n  * Update Cirrus DEST_BRANCH\n  * Bump to v5.2.2-dev\n  * Bump to v5.2.1\n  * Update release notes for v5.2.1\n  * [v5.2] Add zstd:chunked test fix\n  * [v5.2] Bump Buildah to v1.37.1, c/common v0.60.1, c/image v5.32.1\n  * libpod: reset state error on init\n  * libpod: do not save expected stop errors in ctr state\n  * libpod: fix broken saveContainerError()\n  * Bump to v5.2.1-dev\n  * Bump to v5.2.0\n  * Never skip checkout step in release workflow\n  * Bump to v5.2.0-dev\n  * Bump to v5.2.0-rc3\n  * Update release notes for v5.2.0-rc3\n  * Tweak versions in register_images.go\n  * fix network cleanup flake in play kube\n  * WIP: Fixes for vendoring Buildah\n  * Add --compat-volumes option to build and farm build\n  * Bump Buildah, c/storage, c/image, c/common\n  * libpod: bind ports before network setup\n  * pkg/api: do not leak config pointers into specgen\n  * build: Update gvisor-tap-vsock to 0.7.4\n  * test/system: fix borken pasta interface name checks\n  * test/system: fix bridge host.containers.internal test\n  * CI: system tests: instrument to allow failure analysis\n  * Use uploaded .zip for Windows action\n  * RPM: podman-iptables.conf only on Fedora\n  * Bump to v5.2.0-dev\n  * Bump to v5.2.0-rc2\n  * Update release notes for v5.2.0-rc2\n  * test/e2e: fix ncat tests\n  * libpod: add hidden env to set sqlite timeout\n  * Add support for StopSignal in quadlet .container files\n  * podman pod stats: fix race when ctr process exits\n  * Update module github.com/vbauerster/mpb/v8 to v8.7.4\n  * libpod: correctly capture healthcheck output\n  * Bump bundled krunkit to 0.1.2\n  * podman stats: fix race when ctr process exists\n  * nc -p considered harmful\n  * podman pod stats: fix pod rm race\n  * podman ps: fix racy pod name query\n  * system connection remove: use Args function to validate\n  * pkg/machine/compression: skip decompress bar for empty file\n  * nc -p considered harmful\n  * podman system df: fix fix ErrNoSuchCtr/Volume race\n  * podman auto-update: fix ErrNoSuchCtr race\n  * Fix name for builder in farm connection\n  * 700-play.bats: use unique pod/container/image/volume names\n  * safename: consistent within same test, and, dashes\n  * 700-kube.bats: refactor $PODMAN_TMPDIR/test.yaml\n  * 700-play.bats: eliminate $testYaml\n  * 700-play.bats: refactor clumsy yamlfile creation\n  * 700-play.bats: move _write_test_yaml up near top\n  * chore(deps): update dependency setuptools to v71\n  * Expand drop-in search paths * top-level (pod.d) * truncated (unit-.container.d)\n  * Remove references and checks for --gpus\n  * Do not crash on invalid filters\n  * fix(deps): update module github.com/rootless-containers/rootlesskit/v2 to v2.2.0\n  * Bump to v5.2.0-dev\n  * Bump to v5.2.0-rc1\n  * Keep the volume-driver flag deprecated\n  * Vendor in latest containers(common, storage,image, buildah)\n  * System tests: safe container/image/volume/etc names\n  * Implement disable default mounts via command line\n  * test: drop unmount for overlay\n  * test: gracefully terminate server\n  * libpod: shutdown Stop waits for handlers completion\n  * libpod: cleanup store at shutdown\n  * Add NetworkAlias= support to quadlet\n  * cmd: call shutdown handler stop function\n  * fix race conditions in start/attach logic\n  * swagger: exlude new docker network types\n  * vendor: bump c/storage\n  * update to docker 27\n  * contrib: use a distinct --pull-option= for each flag\n  * Update warning message when using external compose provider\n  * Update module github.com/cyphar/filepath-securejoin to v0.3.0\n  * Ignore result of EvalSymlinks on ENOENT\n  * test/upgrade: fix tests when netavark uses nftables\n  * test/system: fix network reload test with nftables\n  * test/e2e: rework some --expose tests\n  * test: remove publish tests from e2e\n  * CI: test nftables driver on fedora\n  * CI: use local registry, part 3 of 3: for developers\n  * CI: use local registry, part 2 of 3: fix tests\n  * CI: use local registry, part 1 of 3: setup\n  * CI: test composefs on rawhide\n  * chore(deps): update module google.golang.org/grpc to v1.64.1 [security]\n  * chore(deps): update dependency setuptools to ~=70.3.0\n  *  Improve container filenname ambiguity.\n  * containers/attach: Note bug around goroutine leak\n  * Drop minikube CI test\n  * add libkrun test docs\n  * fix(deps): update module tags.cncf.io/container-device-interface to v0.8.0\n  * cirrus: check for header files in source code check\n  * pkg/machine/e2e: run debug command only for macos\n  * create runtime\u0027s worker queue before queuing any job\n  * test/system: fix pasta host.containers.internal test\n  * Visual Studio BuildTools as a MinGW alternative\n  * SetupRootless(): only reexec when needed\n  * pkg/rootless: simplify reexec for container code\n  * cirrus: add missing test/tools to danger files\n  * fix(deps): update module golang.org/x/tools to v0.23.0\n  * Windows Installer: switch to wix5\n  * fix(deps): update module golang.org/x/net to v0.27.0\n  * pkg/machine/e2e: print tests timings at the end\n  * pkg/machine/e2e: run debug commands after init\n  * pkg/machine/e2e: improve timeout handling\n  * libpod: first delete container then cidfile\n  * fix(deps): update module golang.org/x/term to v0.22.0\n  * System test fixes\n  * cirrus.yml: automatic skips based on source\n  * fix(deps): update module github.com/containers/ocicrypt to v1.2.0\n  * podman events: fix error race\n  * chore(deps): update dependency setuptools to ~=70.2.0\n  * fix(deps): update module github.com/gorilla/schema to v1.4.1 [security]\n  * Update CI VM images\n  * pkg/machine/e2e: fix broken cleanup\n  * pkg/machine/e2e: use tmp file for connections\n  * test/system: fix podman --image-volume to allow tmpfs storage\n  * CI: mount tmpfs for container storage\n  * docs: --network remove missing leading sentence\n  * specgen: parse devices even with privileged set\n  * vendor: update c/storage\n  * Remove the unused machine volume-driver\n  * feat(quadlet): log option handling\n  * Error when machine memory exceeds system memory\n  * machine: Always use --log-file with gvproxy\n  * CI: Build-Each-Commit test: run only on PRs\n  * Small fixes for testing libkrun\n  * Podman machine resets all providers\n  * Clearly indicate names w/ URLencoded duplicates\n  * [skip-ci] Packit: split rhel and centos-stream jobs\n  * apple virtiofs: fix racy mount setup\n  * cirrus: fix broken macos artifacts URL\n  * libpod/container_top_linux.c: fix missing header\n  * refactor(build): improve err when file specified by -f does not exist\n  * Minor: Remove unhelpful comment\n  * Update module github.com/openshift/imagebuilder to v1.2.11\n  * Minor: Rename the OSX Cross task\n  * [skip-ci] Remove conditionals from changelog\n  * podman top: join the container userns\n  * Run linting in parallel with building\n  * Fix missing Makefile target dependency\n  * build API: accept platform comma separated\n  * [skip-ci] RPM: create podman-machine subpackage\n  * ExitWithError() - more upgrades from Exit()\n  * test/e2e: remove podman system service tests\n  * cirrus: reduce int tests timeout\n  * cirrus: remove redundant skip logic\n  * pkg/machine/apple: machine stop timeout\n  * CI: logformatter: link to correct PR base\n  * Update module github.com/crc-org/crc/v2 to v2.38.0\n  * ExitWithError(): continued\n  * test/system: Add test steps for journald log check in quadlet\n  * restore: fix missing network setup\n  * podman run use pod userns even with --pod-id-file\n  * macos-installer: bundle krunkit\n  * remote API: fix pod top error reporting\n  * libpod API: return proper error status code for pod start\n  * fix #22233\n  * added check for `registry.IsRemote()`. and correct error message.\n  * fix #20686\n  * pkg/machine/e2e: Remove unnecessary copy of machine image.\n  * libpod: intermediate mount if UID not mapped into the userns\n  * libpod: avoid chowning the rundir to root in the userns\n  * libpod: do not chmod bind mounts\n  * libpod: unlock the thread if possible\n  * CI Cleanup: Remove cgroups v1 support\n  * ExitWithError() - more upgrades from Exit()\n  * remote: fix incorrect CONTAINER_CONNECTION parsing\n  * container: pass KillSignal and StopTimeout to the systemd scope\n  * libpod: fix comment\n  * e2e: test container restore in pod by name\n  * docs: Adds all PushImage supported paramters to openapi docs.\n  * systests: kube: bump up a timeout\n  * cirrus.yml: add CI:ALL mode to force all tests\n  * cirrus.yml: implement skips based on source changes\n  * CI VMs: bump\n  * restore: fix container restore into pod\n  * sqlite_state: Fix RewriteVolumeConfig\n  * chore(deps): update dependency setuptools to ~=70.1.0\n  * Quadlet - use specifier for unescaped values for templated container name\n  * cirrus: check for system test leaks in nightly\n  * test/system: check for leaks in teardown suite\n  * test/system: speed up basic_{setup,teardown}()\n  * test/system: fix up many tests that do not cleanup\n  * test/system: fix podman --authfile=nonexistent-path\n  * Update module github.com/containernetworking/plugins to v1.5.1\n  * Update module github.com/checkpoint-restore/checkpointctl to v1.2.1\n  * Update module github.com/spf13/cobra to v1.8.1\n  * Update module github.com/gorilla/schema to v1.4.0\n  * pkg/machine/wsl: force terminate wsl instance\n  * pkg/machine/wsl: wrap command errors\n  * [CI:DOCS] Quadlet - add note about relative path resolution\n  * CI: do not install python packages at runtime\n  * Release workflow: Include candidate descriptor\n  * Minor: Fix indentation in GHA release workflow\n  * GHA: Send release notification mail\n  * GHA: Validate release version number\n  * Remove references to --pull=true and --pull=false\n  * ExitWithError, continued\n  * podman: add new hidden flag --pull-option\n  * [CI:DOCS] Fix typos in podman-build\n  * infra: mark storageSet when imagestore is changed\n  * [CI:DOCS] Add jnovy as reviewer and approver\n  * fix(deps): update module google.golang.org/protobuf to v1.34.2\n  * refactor(machine,wsl): improve operations of Windows API\n  * --squash --layers=false should be allowed\n  * fix(deps): update module github.com/checkpoint-restore/checkpointctl to v1.2.0\n  * update golangci-lint to v1.59.1\n  * Rename master to main in CONTRIBUTING.md\n  * podman 5, pasta and inter-container networking\n  * libpod: do not resuse networking on start\n  * machine/linux: Switch to virtiofs by default\n  * machine/linux: Support virtiofs mounts (retain 9p default)\n  * machine/linux: Use memory-backend-memfd by default\n  * ExitWithError() - continued\n  * Enable libkrun provider to open a debug console\n  * Add new targets on Windows makefile (winmake.ps1)\n  * fix(deps): update module github.com/docker/docker to v26.1.4+incompatible\n  * fix(deps): update module github.com/crc-org/crc/v2 to v2.37.1\n  * fix(deps): update module golang.org/x/tools to v0.22.0\n  * fix(deps): update module golang.org/x/net to v0.26.0\n  * libpod: fix \u0027podman kube generate\u0027 on FreeBSD\n  * fix(deps): update module golang.org/x/sys to v0.21.0\n  * libpod: do not leak systemd hc startup unit timer\n  * vendor latest c/common\n  * pkg/rootless: set _CONTAINERS_USERNS_CONFIGURED correctly\n  * run bats -T, to profile timing hogs\n  * test/system: speed up podman ps --external\n  * test/system: speed up podman network connect/disconnect\n  * test/system: speed up podman network reload\n  * test/system: speed up quadlet - pod simple\n  * test/system: speed up podman parallel build should not race\n  * test/system: speed up podman cp dir from host to container\n  * test/system: speed up podman build - workdir, cmd, env, label\n  * test/system: speed up podman --log-level recognizes log levels\n  * test/system: remove obsolete debug in net connect/disconnect test\n  * test/system: speed up quadlet - basic\n  * test/system: speed up user namespace preserved root ownership\n  * System tests: add `podman system check` tests\n  * Add `podman system check` for checking storage consistency\n  * fix(deps): update module github.com/crc-org/crc/v2 to v2.37.0\n  * fix(libpod): add newline character to the end of container\u0027s hostname file\n  * fix(deps): update module github.com/openshift/imagebuilder to v1.2.10\n  * fix(deps): update github.com/containers/image/v5 digest to aa93504\n  * Fix 5.1 release note re: runlabel\n  * test/e2e: use local skopeo not image\n  * fix(deps): update golang.org/x/exp digest to fd00a4e\n  * [CI:DOCS] Add contrib/podmanimage/stable path back in repo\n  * chore(deps): update dependency requests to ~=2.32.3\n  * fix(deps): update github.com/containers/image/v5 digest to 2343e81\n  * libpod: do not move podman with --cgroups=disabled\n  * Update release notes on Main to v5.1.0\n  * test: look at the file base name\n  * tests: simplify expected output\n  * Sigh, new VMs again\n  * Fail earlier when no containers exist in stats\n  * Add Hyper-V option in windows installer\n  * libpod: cleanup default cache on system reset\n  * vendor: update c/image\n  * test/system: speed up kube generate tmpfs on /tmp\n  * test/system: speed up podman kube play tests\n  * test/system: speed up podman shell completion test\n  * test/system: simplify test signal handling in containers\n  * test/system: speed up podman container rm ...\n  * test/system: speed up podman ps - basic tests\n  * test/system: speed up read-only from containers.conf\n  * test/system: speed up podman logs - multi ...\n  * test/system: speed up podman run --name\n  * Debian: switch to crun\n  * test/system: speed up podman generate systemd - envar\n  * test/system: speed up podman-kube@.service template\n  * test/system: speed up kube play healthcheck initialDelaySeconds\n  * test/system: speed up exit-code propagation test\n  * test/system: speed up \"podman run --timeout\"\n  * test/system: fix slow kube play --wait with siginterrupt\n  * undo auto-formatting\n  * test/system: speed up podman events tests\n  * Quadlet: Add support for .build files\n  * test/system: speed up \"podman auto-update using systemd\"\n  * test/system: remove podman wait test\n  * tests: disable tests affected by a race condition\n  * update golangci-lint to v1.59.0\n  * kubernetes_support.md: Mark volumeMounts.subPath as supported\n  * working name of pod on start and stop\n  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.19.0\n  * Bump Buildah to v1.36.0\n  * fix(deps): update module github.com/burntsushi/toml to v1.4.0\n  * fix typo in Tutorials.rst\n  * Mac PM test: Require pre-installed rosetta\n  * test/e2e: fix new error message\n  * Add configuration for podmansh\n  * Update containers/common to latest main\n  * Only stop chowning volumes once they\u0027re not empty\n  * podman: fix --sdnotify=healthy with --rm\n  * libpod: wait another interval for healthcheck\n  * quadlet: Add a network requirement on .image units\n  * test, pasta: Ignore deprecated addresses in tests\n  * [CI:DOCS] performance: update network docs\n  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.18.0\n  * CI: disable minikube task\n  * [CI:DOCS] Fix windows action trigger\n  * chore(deps): update dependency setuptools to v70\n  * Check AppleHypervisor before accessing it\n  * fix(deps): update module github.com/containernetworking/plugins to v1.5.0\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.58.2\n  * add podman-clean-transient.service service to rootless\n  * [CI:DOCS] Update podman network docs\n  * fix incorrect host.containers.internal entry for rootless bridge mode\n  * vendor latest c/common main\n  * Add Rosetta support for Apple Silicon mac\n  * bump main to 5.2.0-dev\n  * Use a defined constant instead of a hard-coded magic value\n  * cirrus: use faster VM\u0027s for integration tests\n  * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 01a1a0c\n  * [CI:DOCS] Fix Mac pkg link\n  * test: remove test_podman* scripts\n  * test/system: fix documentation\n  * Return StatusNotFound when multiple volumes matching occurs\n  * container_api: do not wait for healtchecks if stopped\n  * libpod: wait for healthy on main thread\n  * `podman events`: check for an error after we finish reading events\n  * remote API: restore v4 payload in container inspect\n  * Fix updating connection when SSH port conflict happens\n  * rootless: fix reexec to use /proc/self/exe\n  * ExitWithError() - enforce required exit status \u0026 stderr\n  * ExitWithError() - a few that I missed\n  * [skip-ci] Packit: use only one value for `packages` key for `trigger: commit` copr builds\n  * Revert \"Temporarily disable rootless debian e2e testing\"\n  * CI tests: enforce TMPDIR on tmpfs\n  * use new CI images with tmpfs /tmp\n  * run e2e test on tmpfs\n  * Update module github.com/crc-org/crc/v2 to v2.36.0\n  * [CI:DOCS] Use checkout@v4 in GH Actions\n  * ExitWithError() - rmi_test\n  * ExitWithError() - more r files\n  * ExitWithError() - s files\n  * ExitWithError() - more run_xxx tests\n  * Fix podman-remote support for `podman farm build`\n  * [CI:DOCS] Trigger windows installer action properly\n  * Revert \"container stop: kill conmon\"\n  * Ensure that containers do not get stuck in stopping\n  * [CI:DOCS] Improvements to make validatepr\n  * ExitWithError() - rest of the p files\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.58.1\n  * Graceful shutdown during podman kube down\n  * Remove duplicate  call\n  * test/system: fix broken \"podman volume globs\" test\n  * Quadlet/Container: Add GroupAdd option\n  * Don\u0027t panic if a runtime was configured without paths\n  * update c/{buildah,common,image,storage} to latest main\n  * update golangci-lint to 1.58\n  * machine: Add LibKrun provider detection\n  * ExitWithError() - continue tightening\n  * fix(deps): update module google.golang.org/protobuf to v1.34.1\n  * test: improve test for powercap presence\n  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.17.3\n  * fix(deps): update module go.etcd.io/bbolt to v1.3.10\n  * fix(deps): update module golang.org/x/tools to v0.21.0\n  * [skip-ci] RPM: `bats` required only on Fedora\n  * fix(deps): update module golang.org/x/exp to v0.0.0-20240506185415-9bf2ced13842\n  * gpdate and remove parameter settings in `.golangci.yml`\n  * ExitWithError() - play_kube_test.go\n  * Temporarily disable rootless debian e2e testing\n  * fix(deps): update module golang.org/x/crypto to v0.23.0\n  * CI Docs: Clarify passthrough_envars() comments\n  * Skip machine tests if they don\u0027t need to be run\n  * Update CI VMs to F40, F39, D13\n  * ExitWithError() - v files\n  * Update module golang.org/x/term to v0.20.0\n  * machine: Add provider detection API\n  * util: specify a not empty pause dir for root too\n  * Add missing option \u0027healthy\u0027 to output of `podman run --help`\n  * [CI:DOCS] Add info on the quay.io images to the README.md\n  * Add a random suffix to healthcheck unit names\n  * test/e2e: remove toolbox image\n  * Also substitute $HOME in runlabel with user\u0027s homedir\n  * Update module github.com/cyphar/filepath-securejoin to v0.2.5\n  * Change tmpDir for macOS\n  * ExitWithError() - pod_xxx tests\n  * ExitWithError() -- run_test.go\n  * Update module golang.org/x/exp to v0.0.0-20240416160154-fe59bbe5cc7f\n  * Update module github.com/shirou/gopsutil/v3 to v3.24.4\n  * Update module github.com/docker/docker to v26.1.1+incompatible\n  * GHA: Attempt fix exceeded a secondary rate limit\n  * vendor ginkgo 2.17.2 into test/tools\n  * Fix machine volumes with long path and paths with dashes\n  * Update module google.golang.org/protobuf to v1.34.0\n  * Update module github.com/crc-org/crc/v2 to v2.35.0\n  * Update module github.com/onsi/gomega to v1.33.1\n  * test/e2e: podman unshare image mount fix tmpdir leak\n  * test/e2e: do not leak /tmp/private_file\n  * test/e2e: \"persistentVolumeClaim with source\" do not leak file\n  * e2e tests: use /var/tmp, not $TMPDIR, as workdirs\n  * Update dependency pytest to v8.1.2\n  * Remove unncessary lines at the end of specfile summary\n  * Clean machine pull cache\n  * Add krun support to podman machine\n  * Use custom image for make validatepr\n  * test/e2e: force systemd cgroup manager\n  * e2e and bindings tests: fix $PATH setup\n  * Makefile: remove useless HACK variable in e2e test\n  * test/e2e: fix volumes and suid/dev/exec options\n  * test/e2e: volumes and suid/dev/exec options works remote\n  * test/e2e: fix limits test\n  * Update module github.com/rootless-containers/rootlesskit/v2 to v2.1.0\n  * Correct option name `ip` -\u003e `ip6`\n  * Add the ability to automount images as volumes via play\n  * Add support for image volume subpaths\n  * Bump Buildah to latest main\n  * Update Makefile to Go 1.22 for in-container\n  * ExitWithError() - yet more low-hanging fruit\n  * ExitWithError() - more low-hanging fruit\n  * ExitWithError() - low-hanging fruit\n  * chore: fix function names in comment\n  * Remove redundant Prerequisite before build section\n  * Remove PKG_CONFIG_PATH\n  * Add installation instructions for openSUSE\n  * Replace golang.org/x/exp/slices with slices from std\n  * Update to go 1.21\n  * fix(deps): update module github.com/docker/docker to v26.1.0+incompatible\n  * [CI:DOCS] Fix artifact action\n  * [skip-ci] Packit/rpm: remove el8 jobs and spec conditionals\n  * e2e tests: stop littering\n  * [CI:DOCS] format podman-pull example as code\n  * [CI:DOCS] Build \u0026 upload release artifacts with GitHub Actions\n  * libpod: getHealthCheckLog() remove unessesary check\n  * add containers.conf healthcheck_events support\n  * vendor latest c/common\n  * libpod: make healthcheck events more efficient\n  * libpod: wrap store setup error message\n  * [skip-ci] Packit: enable CentOS 10 Stream build jobs\n  * pkg/systemd: use fileutils.(Le|E)xists\n  * pkg/bindings: use fileutils.(Le|E)xists\n  * pkg/util: use fileutils.(Le|E)xists\n  * pkg/trust: use fileutils.(Le|E)xists\n  * pkg/specgen: use fileutils.(Le|E)xists\n  * pkg/rootless: use fileutils.(Le|E)xists\n  * pkg/machine: use fileutils.(Le|E)xists\n  * pkg/domain: use fileutils.(Le|E)xists\n  * pkg/api: use fileutils.(Le|E)xists\n  * libpod: use fileutils.(Le|E)xists\n  * cmd: use fileutils.(Le|E)xists\n  * vendor: update containers/{buildah,common,image,storage}\n  * fix(deps): update module github.com/docker/docker to v26.0.2+incompatible [security]\n  * fix podman-pod-restart.1.md typo\n  * [skip-ci] Packit: switch to EPEL instead of centos-stream+epel-next\n  * fix(deps): update module github.com/onsi/gomega to v1.33.0\n  * Add more annnotation information to podman kupe play man page\n  * test/compose: remove compose v1 code\n  * CI: remove compose v1 tests\n  * fix: close resource file\n  * [CI:DOCS] Fix windows installer action\n  * fix(deps): update module tags.cncf.io/container-device-interface to v0.7.2\n  * add `list` as an alias to list networks\n  * Add support for updating restart policy\n  * Add Compat API for Update\n  * Make `podman update` changes persistent\n  * Emergency fix (well, skip) for failing bud tests\n  * fix swagger doc for manifest create\n  * [CI:DOCS] options/network: fix markdown lists\n  * Makefile: do not hardcode `GOOS` in `podman-remote-static` target\n  * chore(deps): update module golang.org/x/crypto to v0.17.0 [security]\n  * chore(deps): update dependency setuptools to ~=69.5.0\n  * Fix some comments\n  * swagger fix infinitive recursion on some types\n  * install swagger from source\n  * Revert \"Swap out javascript engine\"\n  * podman exec CID without command should exit 125\n  * (minor) prefetch systemd image before use\n  * Update go-swagger version\n  * Swap out javascript engine\n  * fix(deps): update module github.com/docker/docker to v26.0.1+incompatible\n  * Add os, arch, and ismanifest to libpod image list\n  * [CI:DOCS]Initial PR validation\n  * fix(deps): update github.com/containers/gvisor-tap-vsock digest to d744d71\n  * vendor ginkgo 2.17.1 into test/tools\n  * fix \"concurrent map writes\" in network ls compat endpoint\n  * chore(deps): update dependency pytest to v8\n  * e2e: redefine ExitWithError() to require exit code\n  * docs: fix missleading run/create --expose description\n  * podman ps: show exposed ports under PORTS as well\n  * rootless: drop function ReadMappingsProc\n  * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.7.3\n  * New CI VMs, to give us pasta 2024-04-05\n  * Add big warning to GHA workflow\n  * GHA: Fix intermittent workflow error\n  * fix(deps): update module golang.org/x/tools to v0.20.0\n  * e2e tests: remove requirement for fuse-overlayfs\n  * docs: update Quadlet volume Options desc\n  * fix(deps): update module golang.org/x/sync to v0.7.0\n  * Fix relabeling failures with Z/z volumes on Mac\n  * fix(deps): update module golang.org/x/net to v0.24.0\n  * Makefile: fix annoying errors in docs generation\n  * chore: fix function names in comment\n  * Bump tags.cncf.io/container-device-interface to v0.7.1\n  * fix(deps): update module golang.org/x/crypto to v0.22.0\n  * Detect unhandled reboots and require user intervention\n  * podman --runroot: remove 50 char length restriction\n  * update github.com/rootless-containers/rootlesskit to v2\n  * Update module github.com/gorilla/schema to v1.3.0\n  * Update dependency requests-mock to ~=1.12.1\n  * Update module github.com/crc-org/crc/v2 to v2.34.1\n  * rm --force work for more than one arg\n  * [CI:DOCS] Update kube docs\n  * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.24.3\n  * [CI:DOCS] Add GitHub action to update version on Podman.io\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.57.2\n  * Windows: clean up temporary perl install\n  * pkg/util: FindDeviceNodes() ignore ENOENT errors\n  * [CI:DOCS] build deps: make-validate needs docs\n  * test/system: add rootless-netns test for setup errors\n  * vendor latest c/common main\n  * container: do not chown to dest target with U\n  * [CI:DOCS] golangci-lint: update deprecated flags\n  * systests: conditionalize slirp4netns tests\n  * CI: systests: instrument flaky tests\n  * s3fs docs\n  * test: do not skip tests under rootless\n  * Add note about host networking to Kube PublishPort option\n  * Inject additional build tags from the environment\n  * libpod: use original IDs if idmap is provided\n  * Switch back to checking out the same branch the action script runs in\n  * docs/podman-login: Give an example of writing the persistent path\n  * CI: Bump VMs to 2024-03-28\n  * [skip-ci] Update dawidd6/action-send-mail action to v3.12.0\n  * fix(deps): update module github.com/openshift/imagebuilder to v1.2.7\n  * Fix reference to deprecated types.Info\n  * Use logformatter for podman_machine_windows_task\n  * applehv: Print vfkit logs in --log-level debug\n  * [CI:DOCS]Add Mario to reviewers list\n  * [CI:DOCS] Document CI-maintenance job addition\n  * Add golang 1.21 update warning\n  * Add rootless network command to `podman info`\n  * libpod: don\u0027t warn about cgroupsv1 on FreeBSD\n  * hyperv: error if not admin\n  * Properly parse stderr when updating container status\n  * [skip-ci] Packit: specify fedora-latest in propose-downstream\n  * Use built-in ssh impl for all non-pty operations\n  * Add support for annotations\n  * hyperv: fix machine rm -r\n  * [skip-ci] Packit: Enable CentOS Stream 10 update job\n  * 5.0 release note fix typo in cgroupv1 env var\n  * fix remote build isolation on client side\n  * chore: remove repetitive words\n  * Dont save remote context in temp file but stream and extract\n  * fix remote build isolation when server runs as root\n  * util: use private propagation with bind\n  * util: add some tests for ProcessOptions\n  * util: refactor ProcessOptions into an internal function\n  * util: rename files to snake case\n  * Add LoongArch support for libpod\n  * fix(deps): update github.com/containers/common digest to bc5f97c\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.57.1\n  * fix(deps): update module github.com/docker/docker to v25.0.5+incompatible [security]\n  * fix(deps): update module github.com/onsi/gomega to v1.32.0\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.57.0\n  * Update module github.com/cpuguy83/go-md2man/v2 to v2.0.4\n  * Fix type-o\n  * Use correct extension in suite\n  * minikube: instrument tests, to allow debugging failures\n  * libpod: restart always reconfigure the netns\n  * use new c/common pasta2 setup logic to fix dns\n  * utils: drop conversion float-\u003estring-\u003efloat\n  * utils: do not generate duplicate range\n  * logformatter: handle Windows logs\n  * utils: add test for the new function\n  * utils: move rootless code to a new function\n  * xref-helpmsgs-manpages: cross-check Commands.rst\n  * test/system: Add support for multipath routes in pasta networking tests\n  * [skip-ci] rpm: use macro supported vendoring\n  * Adjust to the standard location of gvforwarder used in new images\n  * Makefile: add target `podman-remote-static`\n  * Switch to 5.x WSL machine os stream using new automation\n  * Cleanup build scratch dir if remote end disconnects while passing the context\n  * bump main to 5.1.0-dev\n  * Use faster gzip for compression for 3x speedup for sending large contexts to remote\n  * pkg/machine: make checkExclusiveActiveVM race free\n  * pkg/machine/wsl: remove unused CheckExclusiveActiveVM()\n  * pkg/machine: CheckExclusiveActiveVM should also check for starting\n  * pkg/machine: refresh config after we hold lock\n  * Update dependency setuptools to ~=69.2.0\n  * [skip-ci] rpm: update containers-common dep on f40+\n  * fix invalid HTTP header values when hijacking a connection\n  * Add doc to build podman on windows without MSYS\n  * Removing CRI-O related annotations\n  * fix(deps): update module github.com/containers/ocicrypt to v1.1.10\n  * Pass the restart policy to the individual containers\n  * kube play: always pull when both imagePullPolicy and tag are missing\n\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.1-76",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20279-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:20279-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202520279-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:20279-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-June/021043.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1221677",
        "url": "https://bugzilla.suse.com/1221677"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1224112",
        "url": "https://bugzilla.suse.com/1224112"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1231208",
        "url": "https://bugzilla.suse.com/1231208"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1236270",
        "url": "https://bugzilla.suse.com/1236270"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1236507",
        "url": "https://bugzilla.suse.com/1236507"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1237641",
        "url": "https://bugzilla.suse.com/1237641"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1239330",
        "url": "https://bugzilla.suse.com/1239330"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-45288 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-45288/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-11218 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-11218/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-1753 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-1753/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-3727 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-3727/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-9407 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-9407/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22869 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22869/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-27144 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-27144/"
      }
    ],
    "title": "Security update for podman",
    "tracking": {
      "current_release_date": "2025-04-22T13:50:03Z",
      "generator": {
        "date": "2025-04-22T13:50:03Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:20279-1",
      "initial_release_date": "2025-04-22T13:50:03Z",
      "revision_history": [
        {
          "date": "2025-04-22T13:50:03Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-5.2.5-slfo.1.1_1.1.aarch64",
                "product": {
                  "name": "podman-5.2.5-slfo.1.1_1.1.aarch64",
                  "product_id": "podman-5.2.5-slfo.1.1_1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
                "product": {
                  "name": "podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
                  "product_id": "podman-remote-5.2.5-slfo.1.1_1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "podmansh-5.2.5-slfo.1.1_1.1.aarch64",
                "product": {
                  "name": "podmansh-5.2.5-slfo.1.1_1.1.aarch64",
                  "product_id": "podmansh-5.2.5-slfo.1.1_1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-docker-5.2.5-slfo.1.1_1.1.noarch",
                "product": {
                  "name": "podman-docker-5.2.5-slfo.1.1_1.1.noarch",
                  "product_id": "podman-docker-5.2.5-slfo.1.1_1.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-5.2.5-slfo.1.1_1.1.s390x",
                "product": {
                  "name": "podman-5.2.5-slfo.1.1_1.1.s390x",
                  "product_id": "podman-5.2.5-slfo.1.1_1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-5.2.5-slfo.1.1_1.1.s390x",
                "product": {
                  "name": "podman-remote-5.2.5-slfo.1.1_1.1.s390x",
                  "product_id": "podman-remote-5.2.5-slfo.1.1_1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "podmansh-5.2.5-slfo.1.1_1.1.s390x",
                "product": {
                  "name": "podmansh-5.2.5-slfo.1.1_1.1.s390x",
                  "product_id": "podmansh-5.2.5-slfo.1.1_1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-5.2.5-slfo.1.1_1.1.x86_64",
                "product": {
                  "name": "podman-5.2.5-slfo.1.1_1.1.x86_64",
                  "product_id": "podman-5.2.5-slfo.1.1_1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
                "product": {
                  "name": "podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
                  "product_id": "podman-remote-5.2.5-slfo.1.1_1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "podmansh-5.2.5-slfo.1.1_1.1.x86_64",
                "product": {
                  "name": "podmansh-5.2.5-slfo.1.1_1.1.x86_64",
                  "product_id": "podmansh-5.2.5-slfo.1.1_1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.1",
                "product": {
                  "name": "SUSE Linux Micro 6.1",
                  "product_id": "SUSE Linux Micro 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-5.2.5-slfo.1.1_1.1.aarch64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64"
        },
        "product_reference": "podman-5.2.5-slfo.1.1_1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-5.2.5-slfo.1.1_1.1.s390x as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x"
        },
        "product_reference": "podman-5.2.5-slfo.1.1_1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-5.2.5-slfo.1.1_1.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64"
        },
        "product_reference": "podman-5.2.5-slfo.1.1_1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-docker-5.2.5-slfo.1.1_1.1.noarch as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch"
        },
        "product_reference": "podman-docker-5.2.5-slfo.1.1_1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-5.2.5-slfo.1.1_1.1.aarch64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64"
        },
        "product_reference": "podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-5.2.5-slfo.1.1_1.1.s390x as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x"
        },
        "product_reference": "podman-remote-5.2.5-slfo.1.1_1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-5.2.5-slfo.1.1_1.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64"
        },
        "product_reference": "podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podmansh-5.2.5-slfo.1.1_1.1.aarch64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64"
        },
        "product_reference": "podmansh-5.2.5-slfo.1.1_1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podmansh-5.2.5-slfo.1.1_1.1.s390x as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x"
        },
        "product_reference": "podmansh-5.2.5-slfo.1.1_1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podmansh-5.2.5-slfo.1.1_1.1.x86_64 as component of SUSE Linux Micro 6.1",
          "product_id": "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
        },
        "product_reference": "podmansh-5.2.5-slfo.1.1_1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-45288",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-45288"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request\u0027s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
          "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-45288",
          "url": "https://www.suse.com/security/cve/CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1221400 for CVE-2023-45288",
          "url": "https://bugzilla.suse.com/1221400"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-22T13:50:03Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-45288"
    },
    {
      "cve": "CVE-2024-11218",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-11218"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
          "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-11218",
          "url": "https://www.suse.com/security/cve/CVE-2024-11218"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236269 for CVE-2024-11218",
          "url": "https://bugzilla.suse.com/1236269"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-22T13:50:03Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-11218"
    },
    {
      "cve": "CVE-2024-1753",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-1753"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
          "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-1753",
          "url": "https://www.suse.com/security/cve/CVE-2024-1753"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1221677 for CVE-2024-1753",
          "url": "https://bugzilla.suse.com/1221677"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-22T13:50:03Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-1753"
    },
    {
      "cve": "CVE-2024-3727",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-3727"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
          "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-3727",
          "url": "https://www.suse.com/security/cve/CVE-2024-3727"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1224112 for CVE-2024-3727",
          "url": "https://bugzilla.suse.com/1224112"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-22T13:50:03Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-3727"
    },
    {
      "cve": "CVE-2024-9407",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-9407"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
          "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-9407",
          "url": "https://www.suse.com/security/cve/CVE-2024-9407"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231208 for CVE-2024-9407",
          "url": "https://bugzilla.suse.com/1231208"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-22T13:50:03Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-9407"
    },
    {
      "cve": "CVE-2025-22869",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22869"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
          "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22869",
          "url": "https://www.suse.com/security/cve/CVE-2025-22869"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239322 for CVE-2025-22869",
          "url": "https://bugzilla.suse.com/1239322"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-22T13:50:03Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-22869"
    },
    {
      "cve": "CVE-2025-27144",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-27144"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
          "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
          "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-27144",
          "url": "https://www.suse.com/security/cve/CVE-2025-27144"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1237608 for CVE-2025-27144",
          "url": "https://bugzilla.suse.com/1237608"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1237609 for CVE-2025-27144",
          "url": "https://bugzilla.suse.com/1237609"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podman-docker-5.2.5-slfo.1.1_1.1.noarch",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podman-remote-5.2.5-slfo.1.1_1.1.x86_64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.aarch64",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.s390x",
            "SUSE Linux Micro 6.1:podmansh-5.2.5-slfo.1.1_1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-22T13:50:03Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-27144"
    }
  ]
}

CVE-2024-1753 (GCVE-0-2024-1753)

Vulnerability from cvelistv5

Published

2024-03-18 14:23

Modified

2025-08-01 18:14

Severity ?

8.6 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Summary

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

References

►

URL

Tags

	https://access.redhat.com/errata/RHSA-2024:2049	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2055	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2064	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2066	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2077	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2084	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2089	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2090	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2097	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2098	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2548	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2645	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2669	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2672	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2784	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2877	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:3254	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2024-1753	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2265513	issue-tracking, x_refsource_REDHAT
	https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf
	https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3
	https://pkg.go.dev/vuln/GO-2024-2658

Impacted products

Vendor

Product

Version

►

Version: 4.15.0

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8090020240413110917.d7b6f4b7 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8090020240417184044.e7857ab1 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020240419145834.afee755d < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	Unaffected: 8060020240422155330.3b538bd8 < * cpe:/a:redhat:rhel_eus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	Unaffected: 8060020240419071711.2e213529 < * cpe:/a:redhat:rhel_eus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 8080020240422101606.0f77c1b7 < * cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 1:1.31.5-1.el9_3 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 4:4.9.4-3.el9_4 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	Unaffected: 1:1.26.7-1.el9_0 < * cpe:/a:redhat:rhel_eus:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	Unaffected: 2:4.2.0-3.el9_0 < * cpe:/a:redhat:rhel_eus:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 1:1.29.3-1.el9_2 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 2:4.4.1-16.el9_2 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 3:4.4.1-3.2.rhaos4.12.el8 < * cpe:/a:redhat:openshift:4.12::el8 cpe:/a:redhat:openshift:4.12::el9
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 3:4.4.1-5.3.rhaos4.13.el8 < * cpe:/a:redhat:openshift:4.13::el9 cpe:/a:redhat:openshift:4.13::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 3:4.4.1-8.3.rhaos4.13.el9 < * cpe:/a:redhat:openshift:4.13::el9 cpe:/a:redhat:openshift:4.13::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 3:4.4.1-13.4.rhaos4.14.el8 < * cpe:/a:redhat:openshift:4.14::el8 cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 3:4.4.1-23.2.rhaos4.15.el8 < * cpe:/a:redhat:openshift:4.15::el8 cpe:/a:redhat:openshift:4.15::el9
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat OpenShift Container Platform 3.11	cpe:/a:redhat:openshift:3.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1753",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-02T15:05:28.144862Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:00:10.892Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:48:22.005Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2024:2049",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2049"
          },
          {
            "name": "RHSA-2024:2055",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2055"
          },
          {
            "name": "RHSA-2024:2064",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2064"
          },
          {
            "name": "RHSA-2024:2066",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2066"
          },
          {
            "name": "RHSA-2024:2077",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2077"
          },
          {
            "name": "RHSA-2024:2084",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2084"
          },
          {
            "name": "RHSA-2024:2089",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2089"
          },
          {
            "name": "RHSA-2024:2090",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2090"
          },
          {
            "name": "RHSA-2024:2097",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2097"
          },
          {
            "name": "RHSA-2024:2098",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2098"
          },
          {
            "name": "RHSA-2024:2548",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2548"
          },
          {
            "name": "RHSA-2024:2645",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2645"
          },
          {
            "name": "RHSA-2024:2669",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2669"
          },
          {
            "name": "RHSA-2024:2672",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2672"
          },
          {
            "name": "RHSA-2024:2784",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2784"
          },
          {
            "name": "RHSA-2024:2877",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2877"
          },
          {
            "name": "RHSA-2024:3254",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:3254"
          },
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2024-1753"
          },
          {
            "name": "RHBZ#2265513",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265513"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCRZVUDOFM5CPREQKBEU2VK2QK62PSBP/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYMVMQ7RWMDTSKQTBO734BE3WQPI2AJ/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVBSVZGVABPYIHK5HZM472NPGWMI7WXH/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/openshift/builder/",
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "versions": [
            {
              "status": "affected",
              "version": "4.15.0"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:4.0",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8090020240413110917.d7b6f4b7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8090020240417184044.e7857ab1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020240419145834.afee755d",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020240422155330.3b538bd8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:4.0",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020240419071711.2e213529",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020240422101606.0f77c1b7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.31.5-1.el9_3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:4.9.4-3.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.26.7-1.el9_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:4.2.0-3.el9_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.29.3-1.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:4.4.1-16.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.12::el8",
            "cpe:/a:redhat:openshift:4.12::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.12",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-3.2.rhaos4.12.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-5.3.rhaos4.13.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-8.3.rhaos4.13.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el8",
            "cpe:/a:redhat:openshift:4.14::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-13.4.rhaos4.14.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el8",
            "cpe:/a:redhat:openshift:4.15::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-23.2.rhaos4.15.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:3.11"
          ],
          "defaultStatus": "unknown",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 3.11",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2024-03-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-01T18:14:15.934Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:2049",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2049"
        },
        {
          "name": "RHSA-2024:2055",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2055"
        },
        {
          "name": "RHSA-2024:2064",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2064"
        },
        {
          "name": "RHSA-2024:2066",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2066"
        },
        {
          "name": "RHSA-2024:2077",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2077"
        },
        {
          "name": "RHSA-2024:2084",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2084"
        },
        {
          "name": "RHSA-2024:2089",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2089"
        },
        {
          "name": "RHSA-2024:2090",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2090"
        },
        {
          "name": "RHSA-2024:2097",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2097"
        },
        {
          "name": "RHSA-2024:2098",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2098"
        },
        {
          "name": "RHSA-2024:2548",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2548"
        },
        {
          "name": "RHSA-2024:2645",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2645"
        },
        {
          "name": "RHSA-2024:2669",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2669"
        },
        {
          "name": "RHSA-2024:2672",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2672"
        },
        {
          "name": "RHSA-2024:2784",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2784"
        },
        {
          "name": "RHSA-2024:2877",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2877"
        },
        {
          "name": "RHSA-2024:3254",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:3254"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-1753"
        },
        {
          "name": "RHBZ#2265513",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265513"
        },
        {
          "url": "https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf"
        },
        {
          "url": "https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2658"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-02-22T00:00:00+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-03-18T00:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Buildah: full container escape at build time",
      "workarounds": [
        {
          "lang": "en",
          "value": "When SELinux is enabled, the container is restricted to limited read-only access."
        }
      ],
      "x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-1753",
    "datePublished": "2024-03-18T14:23:44.213Z",
    "dateReserved": "2024-02-22T14:42:20.623Z",
    "dateUpdated": "2025-08-01T18:14:15.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-3727 (GCVE-0-2024-3727)

Vulnerability from cvelistv5

Published

2024-05-09 14:57

Modified

2025-07-23 20:01

Severity ?

8.3 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-354 - Improper Validation of Integrity Check Value

Summary

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

References

►

URL

Tags

	https://access.redhat.com/errata/RHSA-2024:0045	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:3718	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:4159	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:4613	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:4850	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:4960	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:5258	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:5951	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:6054	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:6122	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:6708	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:6818	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:6824	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:7164	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:7174	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:7182	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:7187	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:7922	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:7941	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8260	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8425	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9097	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9098	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9102	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9960	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2024-3727	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2274767	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

►

Version: 0 ≤
Version: 5.30.0 ≤

Red Hat	OADP-1.3-RHEL-9	Unaffected: 1.3.4-9 < * cpe:/a:redhat:openshift_api_data_protection:1.3::el9
Red Hat	Red Hat Advanced Cluster Security 4.4	Unaffected: 4.4.5-2 < * cpe:/a:redhat:advanced_cluster_security:4.4::el8
Red Hat	Red Hat Advanced Cluster Security 4.4	Unaffected: 4.4.5-2 < * cpe:/a:redhat:advanced_cluster_security:4.4::el8
Red Hat	Red Hat Advanced Cluster Security 4.4	Unaffected: 4.4.5-2 < * cpe:/a:redhat:advanced_cluster_security:4.4::el8
Red Hat	Red Hat Advanced Cluster Security 4.4	Unaffected: 4.4.5-4 < * cpe:/a:redhat:advanced_cluster_security:4.4::el8
Red Hat	Red Hat Advanced Cluster Security 4.4	Unaffected: 4.4.5-3 < * cpe:/a:redhat:advanced_cluster_security:4.4::el8
Red Hat	Red Hat Advanced Cluster Security 4.4	Unaffected: 4.4.5-2 < * cpe:/a:redhat:advanced_cluster_security:4.4::el8
Red Hat	Red Hat Advanced Cluster Security 4.4	Unaffected: 4.4.5-2 < * cpe:/a:redhat:advanced_cluster_security:4.4::el8
Red Hat	Red Hat Advanced Cluster Security 4.4	Unaffected: 4.4.5-2 < * cpe:/a:redhat:advanced_cluster_security:4.4::el8
Red Hat	Red Hat Advanced Cluster Security 4.4	Unaffected: 4.4.5-3 < * cpe:/a:redhat:advanced_cluster_security:4.4::el8
Red Hat	Red Hat Advanced Cluster Security 4.4	Unaffected: 4.4.5-2 < * cpe:/a:redhat:advanced_cluster_security:4.4::el8
Red Hat	Red Hat Advanced Cluster Security 4.4	Unaffected: 4.4.5-2 < * cpe:/a:redhat:advanced_cluster_security:4.4::el8
Red Hat	Red Hat Advanced Cluster Security 4.4	Unaffected: 4.4.5-3 < * cpe:/a:redhat:advanced_cluster_security:4.4::el8
Red Hat	Red Hat Advanced Cluster Security 4.4	Unaffected: 4.4.5-3 < * cpe:/a:redhat:advanced_cluster_security:4.4::el8
Red Hat	Red Hat Advanced Cluster Security 4.5	Unaffected: 4.5.2-2 < * cpe:/a:redhat:advanced_cluster_security:4.5::el8
Red Hat	Red Hat Advanced Cluster Security 4.5	Unaffected: 4.5.2-2 < * cpe:/a:redhat:advanced_cluster_security:4.5::el8
Red Hat	Red Hat Advanced Cluster Security 4.5	Unaffected: 4.5.2-2 < * cpe:/a:redhat:advanced_cluster_security:4.5::el8
Red Hat	Red Hat Advanced Cluster Security 4.5	Unaffected: 4.5.2-2 < * cpe:/a:redhat:advanced_cluster_security:4.5::el8
Red Hat	Red Hat Advanced Cluster Security 4.5	Unaffected: 4.5.2-2 < * cpe:/a:redhat:advanced_cluster_security:4.5::el8
Red Hat	Red Hat Advanced Cluster Security 4.5	Unaffected: 4.5.2-2 < * cpe:/a:redhat:advanced_cluster_security:4.5::el8
Red Hat	Red Hat Advanced Cluster Security 4.5	Unaffected: 4.5.2-2 < * cpe:/a:redhat:advanced_cluster_security:4.5::el8
Red Hat	Red Hat Advanced Cluster Security 4.5	Unaffected: 4.5.2-2 < * cpe:/a:redhat:advanced_cluster_security:4.5::el8
Red Hat	Red Hat Advanced Cluster Security 4.5	Unaffected: 4.5.2-2 < * cpe:/a:redhat:advanced_cluster_security:4.5::el8
Red Hat	Red Hat Advanced Cluster Security 4.5	Unaffected: 4.5.2-2 < * cpe:/a:redhat:advanced_cluster_security:4.5::el8
Red Hat	Red Hat Advanced Cluster Security 4.5	Unaffected: 4.5.2-1 < * cpe:/a:redhat:advanced_cluster_security:4.5::el8
Red Hat	Red Hat Advanced Cluster Security 4.5	Unaffected: 4.5.2-2 < * cpe:/a:redhat:advanced_cluster_security:4.5::el8
Red Hat	Red Hat Advanced Cluster Security 4.5	Unaffected: 4.5.2-2 < * cpe:/a:redhat:advanced_cluster_security:4.5::el8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020240808093819.afee755d < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.37.2-1.el9 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.16.1-1.el9 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:5.2.2-1.el9 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Migration Toolkit for Containers 1.8	Unaffected: v1.8.4-22 < * cpe:/a:redhat:rhmt:1.8::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 3:4.4.1-13.rhaos4.13.el8 < * cpe:/a:redhat:openshift:4.13::el8 cpe:/a:redhat:openshift_ironic:4.13::el9 cpe:/a:redhat:openshift:4.13::el9
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 2:1.11.3-3.rhaos4.13.el8 < * cpe:/a:redhat:openshift:4.13::el8 cpe:/a:redhat:openshift_ironic:4.13::el9 cpe:/a:redhat:openshift:4.13::el9
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: v4.14.0-202407260439.p0.g8d9b39e.assembly.stream.el8 < * cpe:/a:redhat:openshift:4.14::el9 cpe:/a:redhat:openshift:4.14::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 3:4.4.1-19.rhaos4.14.el9 < * cpe:/a:redhat:openshift:4.14::el9 cpe:/a:redhat:openshift:4.14::el8 cpe:/a:redhat:openshift_ironic:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 2:1.11.3-3.rhaos4.14.el9 < * cpe:/a:redhat:openshift:4.14::el9 cpe:/a:redhat:openshift:4.14::el8 cpe:/a:redhat:openshift_ironic:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409172305.p0.g17536c8.assembly.stream.el8 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409171307.p0.ged4651a.assembly.stream.el8 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409161436.p0.g1f44c02.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409120135.p0.gf7f5eed.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409131835.p0.gadccbd5.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409120135.p0.g8425d88.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409130735.p0.gc03231f.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409131635.p0.gb73e37f.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409161836.p0.g092d15b.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409180105.p0.g1fdd5b0.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409180905.p0.gf6f61ca.assembly.stream.el8 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409171307.p0.g160e7ca.assembly.stream.el8 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409131635.p0.gb7c1d6a.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409111636.p0.gf0c44f6.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409120135.p0.g3ab953d.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409111636.p0.g9ea52de.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409111636.p0.gd80fe46.assembly.stream.el8 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409120135.p0.g8de6f94.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409171307.p0.g5d529dd.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409180305.p0.g1da79fe.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409180305.p0.g1da79fe.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409172305.p0.g5af0be8.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409172305.p0.g5af0be8.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409130536.p0.g1d6a7ed.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409161436.p0.g4121cfc.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409120135.p0.g71a6f28.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409180705.p0.g95ee44e.assembly.stream.el8 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202409161234.p0.g4e8d689.assembly.stream.el8 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 415.92.202409162258-0 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 3:4.4.1-30.rhaos4.15.el8 < * cpe:/a:redhat:openshift_ironic:4.15::el9 cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 2:1.11.3-4.rhaos4.15.el9 < * cpe:/a:redhat:openshift_ironic:4.15::el9 cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202410230304.p0.g366295f.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202410230304.p0.gfde2b2e.assembly.stream.el8 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: v4.15.0-202407230407.p0.gf3f8de5.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 4:4.9.4-5.1.rhaos4.16.el8 < * cpe:/a:redhat:openshift_ironic:4.16::el9 cpe:/a:redhat:openshift:4.16::el9 cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 2:1.14.4-1.rhaos4.16.el9 < * cpe:/a:redhat:openshift_ironic:4.16::el9 cpe:/a:redhat:openshift:4.16::el9 cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:1.29.5-7.rhaos4.16.git7db4ada.el9 < * cpe:/a:redhat:openshift:4.16::el9 cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: v4.16.0-202407171536.p0.g1551101.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: v4.16.0-202409162206.p0.g6a425ab.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: v4.16.0-202409231504.p0.g342902b.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: v4.16.0-202410172201.p0.gb121e87.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: v4.17.0-202409122005.p0.gb170ad0.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: v4.17.0-202409100034.p0.g8d16b39.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: v4.17.0-202409101338.p0.gb0d86a0.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: v4.17.0-202409101338.p0.gb0d86a0.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: v4.17.0-202410022234.p0.gfbc55c6.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: v4.18.0-202502100934.p0.gc00c7c9.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: v4.18.0-202502040032.p0.ge5a4005.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: v4.18.0-202502041302.p0.g51a74ac.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: v4.18.0-202501230001.p0.g5348c85.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: v4.18.0-202502100153.p0.g120ba67.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: v4.18.0-202502060238.p0.g73d65db.assembly.stream.el9 < * cpe:/a:redhat:openshift:4.18::el9
Red Hat	RHEL-9-CNV-4.15	Unaffected: v4.15.5-7 < * cpe:/a:redhat:container_native_virtualization:4.15::el9
Red Hat	Multicluster Engine for Kubernetes	cpe:/a:redhat:multicluster_engine
Red Hat	Multicluster Engine for Kubernetes	cpe:/a:redhat:multicluster_engine
Red Hat	Multicluster Engine for Kubernetes	cpe:/a:redhat:multicluster_engine
Red Hat	Multicluster Engine for Kubernetes	cpe:/a:redhat:multicluster_engine
Red Hat	Multicluster Engine for Kubernetes	cpe:/a:redhat:multicluster_engine
Red Hat	OpenShift Developer Tools and Services	cpe:/a:redhat:ocp_tools
Red Hat	OpenShift Developer Tools and Services	cpe:/a:redhat:ocp_tools
Red Hat	OpenShift Serverless	cpe:/a:redhat:serverless:1
Red Hat	OpenShift Serverless	cpe:/a:redhat:serverless:1
Red Hat	OpenShift Source-to-Image (S2I)	cpe:/a:redhat:source_to_image:1
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	cpe:/a:redhat:acm:2
Red Hat	Red Hat Advanced Cluster Security 3	cpe:/a:redhat:advanced_cluster_security:3
Red Hat	Red Hat Advanced Cluster Security 3	cpe:/a:redhat:advanced_cluster_security:3
Red Hat	Red Hat Advanced Cluster Security 3	cpe:/a:redhat:advanced_cluster_security:3
Red Hat	Red Hat Advanced Cluster Security 3	cpe:/a:redhat:advanced_cluster_security:3
Red Hat	Red Hat Advanced Cluster Security 3	cpe:/a:redhat:advanced_cluster_security:3
Red Hat	Red Hat Advanced Cluster Security 3	cpe:/a:redhat:advanced_cluster_security:3
Red Hat	Red Hat Advanced Cluster Security 3	cpe:/a:redhat:advanced_cluster_security:3
Red Hat	Red Hat Advanced Cluster Security 3	cpe:/a:redhat:advanced_cluster_security:3
Red Hat	Red Hat Ansible Automation Platform 1.2	cpe:/a:redhat:ansible_automation_platform
Red Hat	Red Hat Ansible Automation Platform 2	cpe:/a:redhat:ansible_automation_platform:2
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift Container Platform 3.11	cpe:/a:redhat:openshift:3.11
Red Hat	Red Hat OpenShift Container Platform 3.11	cpe:/a:redhat:openshift:3.11
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform Assisted Installer 1	cpe:/a:redhat:assisted_installer:1
Red Hat	Red Hat OpenShift Container Platform Assisted Installer 1	cpe:/a:redhat:assisted_installer:1
Red Hat	Red Hat OpenShift Container Platform Assisted Installer 1	cpe:/a:redhat:assisted_installer:1
Red Hat	Red Hat OpenShift Dev Spaces	cpe:/a:redhat:openshift_devspaces:3:
Red Hat	Red Hat Openshift Sandboxed Containers	cpe:/a:redhat:openshift_sandboxed_containers:1
Red Hat	Red Hat Openshift Sandboxed Containers	cpe:/a:redhat:openshift_sandboxed_containers:1
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenStack Platform 16.2	cpe:/a:redhat:openstack:16.2
Red Hat	Red Hat Quay 3	cpe:/a:redhat:quay:3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-3727",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-13T17:59:41.318223Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:13.046Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:20:01.029Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2024:0045",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0045"
          },
          {
            "name": "RHSA-2024:4159",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:4159"
          },
          {
            "name": "RHSA-2024:4613",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:4613"
          },
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2024-3727"
          },
          {
            "name": "RHBZ#2274767",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274767"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4HEYS34N55G7NOQZKNEXZKQVNDGEICCD/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6B37TXOKTKDBE2V26X2NSP7JKNMZOFVP/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYT3D2P3OJKISNFKOOHGY6HCUCQZYAVR/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLND3YDQQRWVRIUPL2G5UKXP5L3VSBBT/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DTOMYERG5ND4QFDHC4ZSGCED3T3ESRSC/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FBZQ2ZRMFEUQ35235B2HWPSXGDCBZHFV/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QFXMF3VVKIZN7ZMB7PKZCSWV6MOMTGMQ/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFVSMR7TNLO2KPWJSW4CF64C2QMQXCIN/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/containers/image",
          "defaultStatus": "unaffected",
          "packageName": "image",
          "versions": [
            {
              "lessThan": "5.29.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.30.1",
              "status": "affected",
              "version": "5.30.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_api_data_protection:1.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "oadp/oadp-velero-plugin-rhel9",
          "product": "OADP-1.3-RHEL-9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1.3.4-9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-central-db-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.4.5-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-collector-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.4.5-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-collector-slim-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.4.5-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-main-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.4.5-4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-operator-bundle",
          "product": "Red Hat Advanced Cluster Security 4.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.4.5-3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-rhel8-operator",
          "product": "Red Hat Advanced Cluster Security 4.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.4.5-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-roxctl-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.4.5-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-db-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.4.5-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.4.5-3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.4.5-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-slim-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.4.5-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-v4-db-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.4.5-3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-v4-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.4.5-3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-central-db-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.5.2-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-collector-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.5.2-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-collector-slim-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.5.2-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-main-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.5.2-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-operator-bundle",
          "product": "Red Hat Advanced Cluster Security 4.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.5.2-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-rhel8-operator",
          "product": "Red Hat Advanced Cluster Security 4.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.5.2-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-roxctl-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.5.2-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-db-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.5.2-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.5.2-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.5.2-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-slim-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.5.2-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-v4-db-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.5.2-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:4.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-v4-rhel8",
          "product": "Red Hat Advanced Cluster Security 4.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4.5.2-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020240808093819.afee755d",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.37.2-1.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "skopeo",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.16.1-1.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:5.2.2-1.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhmt:1.8::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhmtc/openshift-migration-controller-rhel8",
          "product": "Red Hat Migration Toolkit for Containers 1.8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v1.8.4-22",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el8",
            "cpe:/a:redhat:openshift_ironic:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-13.rhaos4.13.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el8",
            "cpe:/a:redhat:openshift_ironic:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "skopeo",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.11.3-3.rhaos4.13.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9",
            "cpe:/a:redhat:openshift:4.14::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-operator-lifecycle-manager",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.14.0-202407260439.p0.g8d9b39e.assembly.stream.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9",
            "cpe:/a:redhat:openshift:4.14::el8",
            "cpe:/a:redhat:openshift_ironic:4.14::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-19.rhaos4.14.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9",
            "cpe:/a:redhat:openshift:4.14::el8",
            "cpe:/a:redhat:openshift_ironic:4.14::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "skopeo",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.11.3-3.rhaos4.14.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/network-tools-rhel8",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409172305.p0.g17536c8.assembly.stream.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-agent-installer-api-server-rhel8",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409171307.p0.ged4651a.assembly.stream.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-agent-installer-node-agent-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409161436.p0.g1f44c02.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-alibaba-machine-controllers-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409120135.p0.gf7f5eed.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-apiserver-network-proxy-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409131835.p0.gadccbd5.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-cluster-autoscaler-rhel9-operator",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409120135.p0.g8425d88.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-cluster-control-plane-machine-set-rhel9-operator",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409130735.p0.gc03231f.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-cluster-ingress-rhel9-operator",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409131635.p0.gb73e37f.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-cluster-network-rhel9-operator",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409161836.p0.g092d15b.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-cluster-node-tuning-rhel9-operator",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409180105.p0.g1fdd5b0.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-console",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409180905.p0.gf6f61ca.assembly.stream.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-docker-builder",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409171307.p0.g160e7ca.assembly.stream.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-hypershift-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409131635.p0.gb7c1d6a.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-insights-rhel9-operator",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409111636.p0.gf0c44f6.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-machine-api-rhel9-operator",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409120135.p0.g3ab953d.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-multus-admission-controller-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409111636.p0.g9ea52de.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-multus-whereabouts-ipam-cni-rhel8",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409111636.p0.gd80fe46.assembly.stream.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-nutanix-machine-controllers-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409120135.p0.g8de6f94.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-openshift-controller-manager-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409171307.p0.g5d529dd.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-operator-lifecycle-manager-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409180305.p0.g1da79fe.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-operator-registry-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409180305.p0.g1da79fe.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-ovn-kubernetes-microshift-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409172305.p0.g5af0be8.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-ovn-kubernetes-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409172305.p0.g5af0be8.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-powervs-cloud-controller-manager-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409130536.p0.g1d6a7ed.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-powervs-machine-controllers-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409161436.p0.g4121cfc.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-sdn-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409120135.p0.g71a6f28.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-tests",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409180705.p0.g95ee44e.assembly.stream.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-tools-rhel8",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202409161234.p0.g4e8d689.assembly.stream.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "415.92.202409162258-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_ironic:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-30.rhaos4.15.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_ironic:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "skopeo",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.11.3-4.rhaos4.15.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-agent-installer-node-agent-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202410230304.p0.g366295f.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-agent-installer-orchestrator-rhel8",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202410230304.p0.gfde2b2e.assembly.stream.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-operator-lifecycle-manager-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.0-202407230407.p0.gf3f8de5.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_ironic:4.16::el9",
            "cpe:/a:redhat:openshift:4.16::el9",
            "cpe:/a:redhat:openshift:4.16::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:4.9.4-5.1.rhaos4.16.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_ironic:4.16::el9",
            "cpe:/a:redhat:openshift:4.16::el9",
            "cpe:/a:redhat:openshift:4.16::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "skopeo",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.14.4-1.rhaos4.16.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9",
            "cpe:/a:redhat:openshift:4.16::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "cri-o",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.29.5-7.rhaos4.16.git7db4ada.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-operator-lifecycle-manager-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.16.0-202407171536.p0.g1551101.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-machine-config-rhel9-operator",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.16.0-202409162206.p0.g6a425ab.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-agent-installer-orchestrator-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.16.0-202409231504.p0.g342902b.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-agent-installer-node-agent-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.16.0-202410172201.p0.gb121e87.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-machine-config-rhel9-operator",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.17.0-202409122005.p0.gb170ad0.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-olm-operator-controller-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.17.0-202409100034.p0.g8d16b39.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-operator-lifecycle-manager-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.17.0-202409101338.p0.gb0d86a0.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-operator-registry-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.17.0-202409101338.p0.gb0d86a0.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-agent-installer-orchestrator-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.17.0-202410022234.p0.gfbc55c6.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/oc-mirror-plugin-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.18.0-202502100934.p0.gc00c7c9.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-agent-installer-api-server-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.18.0-202502040032.p0.ge5a4005.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-agent-installer-node-agent-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.18.0-202502041302.p0.g51a74ac.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-agent-installer-orchestrator-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.18.0-202501230001.p0.g5348c85.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-machine-config-rhel9-operator",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.18.0-202502100153.p0.g120ba67.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-openshift-apiserver-rhel9",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.18.0-202502060238.p0.g73d65db.assembly.stream.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.15::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-cdi-controller-rhel9",
          "product": "RHEL-9-CNV-4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "v4.15.5-7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine"
          ],
          "defaultStatus": "unaffected",
          "packageName": "multicluster-engine/agent-service-rhel8",
          "product": "Multicluster Engine for Kubernetes",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine"
          ],
          "defaultStatus": "unaffected",
          "packageName": "multicluster-engine/assisted-installer-agent-rhel8",
          "product": "Multicluster Engine for Kubernetes",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine"
          ],
          "defaultStatus": "unaffected",
          "packageName": "multicluster-engine/assisted-installer-reporter-rhel8",
          "product": "Multicluster Engine for Kubernetes",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine"
          ],
          "defaultStatus": "unaffected",
          "packageName": "multicluster-engine/assisted-installer-rhel8",
          "product": "Multicluster Engine for Kubernetes",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine"
          ],
          "defaultStatus": "unaffected",
          "packageName": "multicluster-engine/hive-rhel8",
          "product": "Multicluster Engine for Kubernetes",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ocp_tools"
          ],
          "defaultStatus": "affected",
          "packageName": "ocp-tools-4/jenkins-agent-base-rhel8",
          "product": "OpenShift Developer Tools and Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ocp_tools"
          ],
          "defaultStatus": "affected",
          "packageName": "ocp-tools-4/jenkins-rhel8",
          "product": "OpenShift Developer Tools and Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-1/client-kn-rhel8",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-clients",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:source_to_image:1"
          ],
          "defaultStatus": "affected",
          "packageName": "source-to-image-container",
          "product": "OpenShift Source-to-Image (S2I)",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:acm:2"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhacm2/submariner-rhel8-operator",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:3"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-central-db-rhel8",
          "product": "Red Hat Advanced Cluster Security 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:3"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-main-rhel8",
          "product": "Red Hat Advanced Cluster Security 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:3"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-rhel8-operator",
          "product": "Red Hat Advanced Cluster Security 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:3"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-roxctl-rhel8",
          "product": "Red Hat Advanced Cluster Security 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:3"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-db-rhel8",
          "product": "Red Hat Advanced Cluster Security 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:3"
          ],
          "defaultStatus": "unaffected",
          "packageName": "advanced-cluster-security/rhacs-scanner-db-slim-rhel8",
          "product": "Red Hat Advanced Cluster Security 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:3"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-rhel8",
          "product": "Red Hat Advanced Cluster Security 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:advanced_cluster_security:3"
          ],
          "defaultStatus": "affected",
          "packageName": "advanced-cluster-security/rhacs-scanner-slim-rhel8",
          "product": "Red Hat Advanced Cluster Security 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift-clients",
          "product": "Red Hat Ansible Automation Platform 1.2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift-clients",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "conmon",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "containers-common",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "osbuild-composer",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "skopeo",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "skopeo",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "container-tools:4.0/buildah",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "container-tools:4.0/conmon",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "container-tools:4.0/containers-common",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:4.0/podman",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "container-tools:4.0/skopeo",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "osbuild-composer",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "conmon",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "containers-common",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "osbuild-composer",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:3.11"
          ],
          "defaultStatus": "unknown",
          "packageName": "atomic-openshift",
          "product": "Red Hat OpenShift Container Platform 3.11",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:3.11"
          ],
          "defaultStatus": "unknown",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 3.11",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "conmon",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "containers-common",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-agent-installer-csr-approver-rhel9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift4/ose-baremetal-installer-rhel8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-cli",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-cli-artifacts",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-deployer",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-installer",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift4/ose-installer-altinfra-rhel9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift4/ose-installer-artifacts",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-olm-rukpak-rhel8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift4/ose-openshift-proxy-pull-test-rhel8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-clients",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "ose-installer-terraform-providers-container",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:assisted_installer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhai-tech-preview/assisted-installer-agent-rhel8",
          "product": "Red Hat OpenShift Container Platform Assisted Installer 1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:assisted_installer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhai-tech-preview/assisted-installer-reporter-rhel8",
          "product": "Red Hat OpenShift Container Platform Assisted Installer 1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:assisted_installer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhai-tech-preview/assisted-installer-rhel8",
          "product": "Red Hat OpenShift Container Platform Assisted Installer 1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3:"
          ],
          "defaultStatus": "affected",
          "packageName": "devspaces/udi-rhel8",
          "product": "Red Hat OpenShift Dev Spaces",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_sandboxed_containers:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-sandboxed-containers/osc-must-gather-rhel8",
          "product": "Red Hat Openshift Sandboxed Containers",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_sandboxed_containers:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-sandboxed-containers/osc-rhel8-operator",
          "product": "Red Hat Openshift Sandboxed Containers",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-cdi-apiserver",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-cdi-apiserver-rhel9",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-cdi-cloner",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-cdi-cloner-rhel9",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-cdi-controller",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-cdi-importer",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-cdi-importer-rhel9",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-cdi-operator",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-cdi-operator-rhel9",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-cdi-uploadproxy",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-cdi-uploadproxy-rhel9",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-cdi-uploadserver",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "container-native-virtualization/virt-cdi-uploadserver-rhel9",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openstack:16.2"
          ],
          "defaultStatus": "affected",
          "packageName": "osp-director-provisioner-container",
          "product": "Red Hat OpenStack Platform 16.2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:quay:3"
          ],
          "defaultStatus": "unaffected",
          "packageName": "quay/quay-builder-rhel8",
          "product": "Red Hat Quay 3",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2024-05-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-354",
              "description": "Improper Validation of Integrity Check Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-23T20:01:49.040Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:0045",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0045"
        },
        {
          "name": "RHSA-2024:3718",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:3718"
        },
        {
          "name": "RHSA-2024:4159",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:4159"
        },
        {
          "name": "RHSA-2024:4613",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:4613"
        },
        {
          "name": "RHSA-2024:4850",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:4850"
        },
        {
          "name": "RHSA-2024:4960",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:4960"
        },
        {
          "name": "RHSA-2024:5258",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:5258"
        },
        {
          "name": "RHSA-2024:5951",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:5951"
        },
        {
          "name": "RHSA-2024:6054",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6054"
        },
        {
          "name": "RHSA-2024:6122",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6122"
        },
        {
          "name": "RHSA-2024:6708",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6708"
        },
        {
          "name": "RHSA-2024:6818",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6818"
        },
        {
          "name": "RHSA-2024:6824",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6824"
        },
        {
          "name": "RHSA-2024:7164",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:7164"
        },
        {
          "name": "RHSA-2024:7174",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:7174"
        },
        {
          "name": "RHSA-2024:7182",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:7182"
        },
        {
          "name": "RHSA-2024:7187",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:7187"
        },
        {
          "name": "RHSA-2024:7922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:7922"
        },
        {
          "name": "RHSA-2024:7941",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:7941"
        },
        {
          "name": "RHSA-2024:8260",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8260"
        },
        {
          "name": "RHSA-2024:8425",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8425"
        },
        {
          "name": "RHSA-2024:9097",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9097"
        },
        {
          "name": "RHSA-2024:9098",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9098"
        },
        {
          "name": "RHSA-2024:9102",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9102"
        },
        {
          "name": "RHSA-2024:9960",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9960"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-3727"
        },
        {
          "name": "RHBZ#2274767",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274767"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-04-12T00:00:00+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-05-09T00:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Containers/image: digest type does not guarantee valid type",
      "x_redhatCweChain": "CWE-354: Improper Validation of Integrity Check Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-3727",
    "datePublished": "2024-05-09T14:57:21.327Z",
    "dateReserved": "2024-04-12T17:56:37.261Z",
    "dateUpdated": "2025-07-23T20:01:49.040Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-22869 (GCVE-0-2025-22869)

Vulnerability from cvelistv5

Published

2025-02-26 03:07

Modified

2025-04-11 22:03

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-770: Allocation of Resources Without Limits or Throttling

Summary

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

References

►

URL

Tags

	https://go.dev/cl/652135
	https://go.dev/issue/71931
	https://pkg.go.dev/vuln/GO-2025-3487

Impacted products

	Vendor	Product	Version
	golang.org/x/crypto	golang.org/x/crypto/ssh	Version: 0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22869",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-26T14:57:07.968721Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-26T14:57:49.252Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-04-11T22:03:24.222Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250411-0010/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/crypto/ssh",
          "product": "golang.org/x/crypto/ssh",
          "programRoutines": [
            {
              "name": "newHandshakeTransport"
            },
            {
              "name": "handshakeTransport.recordWriteError"
            },
            {
              "name": "handshakeTransport.kexLoop"
            },
            {
              "name": "handshakeTransport.writePacket"
            },
            {
              "name": "Client.Dial"
            },
            {
              "name": "Client.DialContext"
            },
            {
              "name": "Client.DialTCP"
            },
            {
              "name": "Client.Listen"
            },
            {
              "name": "Client.ListenTCP"
            },
            {
              "name": "Client.ListenUnix"
            },
            {
              "name": "Client.NewSession"
            },
            {
              "name": "Dial"
            },
            {
              "name": "DiscardRequests"
            },
            {
              "name": "NewClient"
            },
            {
              "name": "NewClientConn"
            },
            {
              "name": "NewServerConn"
            },
            {
              "name": "Request.Reply"
            },
            {
              "name": "Session.Close"
            },
            {
              "name": "Session.CombinedOutput"
            },
            {
              "name": "Session.Output"
            },
            {
              "name": "Session.RequestPty"
            },
            {
              "name": "Session.RequestSubsystem"
            },
            {
              "name": "Session.Run"
            },
            {
              "name": "Session.SendRequest"
            },
            {
              "name": "Session.Setenv"
            },
            {
              "name": "Session.Shell"
            },
            {
              "name": "Session.Signal"
            },
            {
              "name": "Session.Start"
            },
            {
              "name": "Session.WindowChange"
            },
            {
              "name": "channel.Accept"
            },
            {
              "name": "channel.Close"
            },
            {
              "name": "channel.CloseWrite"
            },
            {
              "name": "channel.Read"
            },
            {
              "name": "channel.ReadExtended"
            },
            {
              "name": "channel.Reject"
            },
            {
              "name": "channel.SendRequest"
            },
            {
              "name": "channel.Write"
            },
            {
              "name": "channel.WriteExtended"
            },
            {
              "name": "connection.SendAuthBanner"
            },
            {
              "name": "curve25519sha256.Client"
            },
            {
              "name": "curve25519sha256.Server"
            },
            {
              "name": "dhGEXSHA.Client"
            },
            {
              "name": "dhGEXSHA.Server"
            },
            {
              "name": "dhGroup.Client"
            },
            {
              "name": "dhGroup.Server"
            },
            {
              "name": "ecdh.Client"
            },
            {
              "name": "ecdh.Server"
            },
            {
              "name": "extChannel.Read"
            },
            {
              "name": "extChannel.Write"
            },
            {
              "name": "mux.OpenChannel"
            },
            {
              "name": "mux.SendRequest"
            },
            {
              "name": "sessionStdin.Close"
            },
            {
              "name": "sshClientKeyboardInteractive.Challenge"
            },
            {
              "name": "tcpListener.Accept"
            },
            {
              "name": "tcpListener.Close"
            },
            {
              "name": "unixListener.Accept"
            },
            {
              "name": "unixListener.Close"
            }
          ],
          "vendor": "golang.org/x/crypto",
          "versions": [
            {
              "lessThan": "0.35.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Yuichi Watanabe"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-26T03:07:48.855Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/652135"
        },
        {
          "url": "https://go.dev/issue/71931"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2025-3487"
        }
      ],
      "title": "Potential denial of service in golang.org/x/crypto"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-22869",
    "datePublished": "2025-02-26T03:07:48.855Z",
    "dateReserved": "2025-01-08T19:11:42.834Z",
    "dateUpdated": "2025-04-11T22:03:24.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-27144 (GCVE-0-2025-27144)

Vulnerability from cvelistv5

Published

2025-02-24 22:22

Modified

2025-02-25 14:27

Severity ?

6.6 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Summary

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.

References

►

URL

Tags

	https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78	x_refsource_CONFIRM
	https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc22	x_refsource_MISC
	https://github.com/go-jose/go-jose/releases/tag/v4.0.5	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	go-jose	go-jose	Version: >= 4.0.0, < 4.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27144",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-25T14:26:42.682392Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-25T14:27:04.978Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go-jose",
          "vendor": "go-jose",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-24T22:22:22.863Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78"
        },
        {
          "name": "https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc22",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc22"
        },
        {
          "name": "https://github.com/go-jose/go-jose/releases/tag/v4.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-jose/go-jose/releases/tag/v4.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-c6gw-w398-hv78",
        "discovery": "UNKNOWN"
      },
      "title": "Go JOSE\u0027s Parsing Vulnerable to Denial of Service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-27144",
    "datePublished": "2025-02-24T22:22:22.863Z",
    "dateReserved": "2025-02-19T16:30:47.777Z",
    "dateUpdated": "2025-02-25T14:27:04.978Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45288 (GCVE-0-2023-45288)

Vulnerability from cvelistv5

Published

2024-04-04 20:37

Modified

2025-02-13 17:14

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400: Uncontrolled Resource Consumption

Summary

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

References

►

URL

Tags

	https://go.dev/issue/65051
	https://go.dev/cl/576155
	https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M
	https://pkg.go.dev/vuln/GO-2024-2687
	https://security.netapp.com/advisory/ntap-20240419-0009/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/
	http://www.openwall.com/lists/oss-security/2024/04/05/4
	http://www.openwall.com/lists/oss-security/2024/04/03/16

Impacted products

Vendor

Product

Version

►

Go standard library

net/http

Version: 0 ≤
Version: 1.22.0-0 ≤

golang.org/x/net

golang.org/x/net/http2

Version: 0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:21:15.329Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/65051"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/576155"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2024-2687"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240419-0009/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/04/05/4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/04/03/16"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:go_standard_library:net\\/http:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "net\\/http",
            "vendor": "go_standard_library",
            "versions": [
              {
                "lessThan": "1.21.9",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "1.22.2",
                "status": "affected",
                "version": "1.22.0-0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:golang:http2:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "http2",
            "vendor": "golang",
            "versions": [
              {
                "lessThan": "0.23.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-45288",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-05T17:08:42.212936Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-26T20:40:01.996Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "http2Framer.readMetaFrame"
            },
            {
              "name": "CanonicalHeaderKey"
            },
            {
              "name": "Client.CloseIdleConnections"
            },
            {
              "name": "Client.Do"
            },
            {
              "name": "Client.Get"
            },
            {
              "name": "Client.Head"
            },
            {
              "name": "Client.Post"
            },
            {
              "name": "Client.PostForm"
            },
            {
              "name": "Cookie.String"
            },
            {
              "name": "Cookie.Valid"
            },
            {
              "name": "Dir.Open"
            },
            {
              "name": "Error"
            },
            {
              "name": "Get"
            },
            {
              "name": "HandlerFunc.ServeHTTP"
            },
            {
              "name": "Head"
            },
            {
              "name": "Header.Add"
            },
            {
              "name": "Header.Del"
            },
            {
              "name": "Header.Get"
            },
            {
              "name": "Header.Set"
            },
            {
              "name": "Header.Values"
            },
            {
              "name": "Header.Write"
            },
            {
              "name": "Header.WriteSubset"
            },
            {
              "name": "ListenAndServe"
            },
            {
              "name": "ListenAndServeTLS"
            },
            {
              "name": "NewRequest"
            },
            {
              "name": "NewRequestWithContext"
            },
            {
              "name": "NotFound"
            },
            {
              "name": "ParseTime"
            },
            {
              "name": "Post"
            },
            {
              "name": "PostForm"
            },
            {
              "name": "ProxyFromEnvironment"
            },
            {
              "name": "ReadRequest"
            },
            {
              "name": "ReadResponse"
            },
            {
              "name": "Redirect"
            },
            {
              "name": "Request.AddCookie"
            },
            {
              "name": "Request.BasicAuth"
            },
            {
              "name": "Request.FormFile"
            },
            {
              "name": "Request.FormValue"
            },
            {
              "name": "Request.MultipartReader"
            },
            {
              "name": "Request.ParseForm"
            },
            {
              "name": "Request.ParseMultipartForm"
            },
            {
              "name": "Request.PostFormValue"
            },
            {
              "name": "Request.Referer"
            },
            {
              "name": "Request.SetBasicAuth"
            },
            {
              "name": "Request.UserAgent"
            },
            {
              "name": "Request.Write"
            },
            {
              "name": "Request.WriteProxy"
            },
            {
              "name": "Response.Cookies"
            },
            {
              "name": "Response.Location"
            },
            {
              "name": "Response.Write"
            },
            {
              "name": "ResponseController.EnableFullDuplex"
            },
            {
              "name": "ResponseController.Flush"
            },
            {
              "name": "ResponseController.Hijack"
            },
            {
              "name": "ResponseController.SetReadDeadline"
            },
            {
              "name": "ResponseController.SetWriteDeadline"
            },
            {
              "name": "Serve"
            },
            {
              "name": "ServeContent"
            },
            {
              "name": "ServeFile"
            },
            {
              "name": "ServeMux.ServeHTTP"
            },
            {
              "name": "ServeTLS"
            },
            {
              "name": "Server.Close"
            },
            {
              "name": "Server.ListenAndServe"
            },
            {
              "name": "Server.ListenAndServeTLS"
            },
            {
              "name": "Server.Serve"
            },
            {
              "name": "Server.ServeTLS"
            },
            {
              "name": "Server.SetKeepAlivesEnabled"
            },
            {
              "name": "Server.Shutdown"
            },
            {
              "name": "SetCookie"
            },
            {
              "name": "Transport.CancelRequest"
            },
            {
              "name": "Transport.Clone"
            },
            {
              "name": "Transport.CloseIdleConnections"
            },
            {
              "name": "Transport.RoundTrip"
            },
            {
              "name": "body.Close"
            },
            {
              "name": "body.Read"
            },
            {
              "name": "bodyEOFSignal.Close"
            },
            {
              "name": "bodyEOFSignal.Read"
            },
            {
              "name": "bodyLocked.Read"
            },
            {
              "name": "bufioFlushWriter.Write"
            },
            {
              "name": "cancelTimerBody.Close"
            },
            {
              "name": "cancelTimerBody.Read"
            },
            {
              "name": "checkConnErrorWriter.Write"
            },
            {
              "name": "chunkWriter.Write"
            },
            {
              "name": "connReader.Read"
            },
            {
              "name": "connectMethodKey.String"
            },
            {
              "name": "expectContinueReader.Close"
            },
            {
              "name": "expectContinueReader.Read"
            },
            {
              "name": "extraHeader.Write"
            },
            {
              "name": "fileHandler.ServeHTTP"
            },
            {
              "name": "fileTransport.RoundTrip"
            },
            {
              "name": "globalOptionsHandler.ServeHTTP"
            },
            {
              "name": "gzipReader.Close"
            },
            {
              "name": "gzipReader.Read"
            },
            {
              "name": "http2ClientConn.Close"
            },
            {
              "name": "http2ClientConn.Ping"
            },
            {
              "name": "http2ClientConn.RoundTrip"
            },
            {
              "name": "http2ClientConn.Shutdown"
            },
            {
              "name": "http2ConnectionError.Error"
            },
            {
              "name": "http2ErrCode.String"
            },
            {
              "name": "http2FrameHeader.String"
            },
            {
              "name": "http2FrameType.String"
            },
            {
              "name": "http2FrameWriteRequest.String"
            },
            {
              "name": "http2Framer.ReadFrame"
            },
            {
              "name": "http2Framer.WriteContinuation"
            },
            {
              "name": "http2Framer.WriteData"
            },
            {
              "name": "http2Framer.WriteDataPadded"
            },
            {
              "name": "http2Framer.WriteGoAway"
            },
            {
              "name": "http2Framer.WriteHeaders"
            },
            {
              "name": "http2Framer.WritePing"
            },
            {
              "name": "http2Framer.WritePriority"
            },
            {
              "name": "http2Framer.WritePushPromise"
            },
            {
              "name": "http2Framer.WriteRSTStream"
            },
            {
              "name": "http2Framer.WriteRawFrame"
            },
            {
              "name": "http2Framer.WriteSettings"
            },
            {
              "name": "http2Framer.WriteSettingsAck"
            },
            {
              "name": "http2Framer.WriteWindowUpdate"
            },
            {
              "name": "http2GoAwayError.Error"
            },
            {
              "name": "http2Server.ServeConn"
            },
            {
              "name": "http2Setting.String"
            },
            {
              "name": "http2SettingID.String"
            },
            {
              "name": "http2SettingsFrame.ForeachSetting"
            },
            {
              "name": "http2StreamError.Error"
            },
            {
              "name": "http2Transport.CloseIdleConnections"
            },
            {
              "name": "http2Transport.NewClientConn"
            },
            {
              "name": "http2Transport.RoundTrip"
            },
            {
              "name": "http2Transport.RoundTripOpt"
            },
            {
              "name": "http2bufferedWriter.Flush"
            },
            {
              "name": "http2bufferedWriter.Write"
            },
            {
              "name": "http2chunkWriter.Write"
            },
            {
              "name": "http2clientConnPool.GetClientConn"
            },
            {
              "name": "http2connError.Error"
            },
            {
              "name": "http2dataBuffer.Read"
            },
            {
              "name": "http2duplicatePseudoHeaderError.Error"
            },
            {
              "name": "http2gzipReader.Close"
            },
            {
              "name": "http2gzipReader.Read"
            },
            {
              "name": "http2headerFieldNameError.Error"
            },
            {
              "name": "http2headerFieldValueError.Error"
            },
            {
              "name": "http2noDialClientConnPool.GetClientConn"
            },
            {
              "name": "http2noDialH2RoundTripper.RoundTrip"
            },
            {
              "name": "http2pipe.Read"
            },
            {
              "name": "http2priorityWriteScheduler.CloseStream"
            },
            {
              "name": "http2priorityWriteScheduler.OpenStream"
            },
            {
              "name": "http2pseudoHeaderError.Error"
            },
            {
              "name": "http2requestBody.Close"
            },
            {
              "name": "http2requestBody.Read"
            },
            {
              "name": "http2responseWriter.Flush"
            },
            {
              "name": "http2responseWriter.FlushError"
            },
            {
              "name": "http2responseWriter.Push"
            },
            {
              "name": "http2responseWriter.SetReadDeadline"
            },
            {
              "name": "http2responseWriter.SetWriteDeadline"
            },
            {
              "name": "http2responseWriter.Write"
            },
            {
              "name": "http2responseWriter.WriteHeader"
            },
            {
              "name": "http2responseWriter.WriteString"
            },
            {
              "name": "http2roundRobinWriteScheduler.OpenStream"
            },
            {
              "name": "http2serverConn.CloseConn"
            },
            {
              "name": "http2serverConn.Flush"
            },
            {
              "name": "http2stickyErrWriter.Write"
            },
            {
              "name": "http2transportResponseBody.Close"
            },
            {
              "name": "http2transportResponseBody.Read"
            },
            {
              "name": "http2writeData.String"
            },
            {
              "name": "initALPNRequest.ServeHTTP"
            },
            {
              "name": "loggingConn.Close"
            },
            {
              "name": "loggingConn.Read"
            },
            {
              "name": "loggingConn.Write"
            },
            {
              "name": "maxBytesReader.Close"
            },
            {
              "name": "maxBytesReader.Read"
            },
            {
              "name": "onceCloseListener.Close"
            },
            {
              "name": "persistConn.Read"
            },
            {
              "name": "persistConnWriter.ReadFrom"
            },
            {
              "name": "persistConnWriter.Write"
            },
            {
              "name": "populateResponse.Write"
            },
            {
              "name": "populateResponse.WriteHeader"
            },
            {
              "name": "readTrackingBody.Close"
            },
            {
              "name": "readTrackingBody.Read"
            },
            {
              "name": "readWriteCloserBody.Read"
            },
            {
              "name": "redirectHandler.ServeHTTP"
            },
            {
              "name": "response.Flush"
            },
            {
              "name": "response.FlushError"
            },
            {
              "name": "response.Hijack"
            },
            {
              "name": "response.ReadFrom"
            },
            {
              "name": "response.Write"
            },
            {
              "name": "response.WriteHeader"
            },
            {
              "name": "response.WriteString"
            },
            {
              "name": "serverHandler.ServeHTTP"
            },
            {
              "name": "socksDialer.DialWithConn"
            },
            {
              "name": "socksUsernamePassword.Authenticate"
            },
            {
              "name": "stringWriter.WriteString"
            },
            {
              "name": "timeoutHandler.ServeHTTP"
            },
            {
              "name": "timeoutWriter.Write"
            },
            {
              "name": "timeoutWriter.WriteHeader"
            },
            {
              "name": "transportReadFromServerError.Error"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.21.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.22.2",
              "status": "affected",
              "version": "1.22.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/net/http2",
          "product": "golang.org/x/net/http2",
          "programRoutines": [
            {
              "name": "Framer.readMetaFrame"
            },
            {
              "name": "ClientConn.Close"
            },
            {
              "name": "ClientConn.Ping"
            },
            {
              "name": "ClientConn.RoundTrip"
            },
            {
              "name": "ClientConn.Shutdown"
            },
            {
              "name": "ConfigureServer"
            },
            {
              "name": "ConfigureTransport"
            },
            {
              "name": "ConfigureTransports"
            },
            {
              "name": "ConnectionError.Error"
            },
            {
              "name": "ErrCode.String"
            },
            {
              "name": "FrameHeader.String"
            },
            {
              "name": "FrameType.String"
            },
            {
              "name": "FrameWriteRequest.String"
            },
            {
              "name": "Framer.ReadFrame"
            },
            {
              "name": "Framer.WriteContinuation"
            },
            {
              "name": "Framer.WriteData"
            },
            {
              "name": "Framer.WriteDataPadded"
            },
            {
              "name": "Framer.WriteGoAway"
            },
            {
              "name": "Framer.WriteHeaders"
            },
            {
              "name": "Framer.WritePing"
            },
            {
              "name": "Framer.WritePriority"
            },
            {
              "name": "Framer.WritePushPromise"
            },
            {
              "name": "Framer.WriteRSTStream"
            },
            {
              "name": "Framer.WriteRawFrame"
            },
            {
              "name": "Framer.WriteSettings"
            },
            {
              "name": "Framer.WriteSettingsAck"
            },
            {
              "name": "Framer.WriteWindowUpdate"
            },
            {
              "name": "GoAwayError.Error"
            },
            {
              "name": "ReadFrameHeader"
            },
            {
              "name": "Server.ServeConn"
            },
            {
              "name": "Setting.String"
            },
            {
              "name": "SettingID.String"
            },
            {
              "name": "SettingsFrame.ForeachSetting"
            },
            {
              "name": "StreamError.Error"
            },
            {
              "name": "Transport.CloseIdleConnections"
            },
            {
              "name": "Transport.NewClientConn"
            },
            {
              "name": "Transport.RoundTrip"
            },
            {
              "name": "Transport.RoundTripOpt"
            },
            {
              "name": "bufferedWriter.Flush"
            },
            {
              "name": "bufferedWriter.Write"
            },
            {
              "name": "chunkWriter.Write"
            },
            {
              "name": "clientConnPool.GetClientConn"
            },
            {
              "name": "connError.Error"
            },
            {
              "name": "dataBuffer.Read"
            },
            {
              "name": "duplicatePseudoHeaderError.Error"
            },
            {
              "name": "gzipReader.Close"
            },
            {
              "name": "gzipReader.Read"
            },
            {
              "name": "headerFieldNameError.Error"
            },
            {
              "name": "headerFieldValueError.Error"
            },
            {
              "name": "noDialClientConnPool.GetClientConn"
            },
            {
              "name": "noDialH2RoundTripper.RoundTrip"
            },
            {
              "name": "pipe.Read"
            },
            {
              "name": "priorityWriteScheduler.CloseStream"
            },
            {
              "name": "priorityWriteScheduler.OpenStream"
            },
            {
              "name": "pseudoHeaderError.Error"
            },
            {
              "name": "requestBody.Close"
            },
            {
              "name": "requestBody.Read"
            },
            {
              "name": "responseWriter.Flush"
            },
            {
              "name": "responseWriter.FlushError"
            },
            {
              "name": "responseWriter.Push"
            },
            {
              "name": "responseWriter.SetReadDeadline"
            },
            {
              "name": "responseWriter.SetWriteDeadline"
            },
            {
              "name": "responseWriter.Write"
            },
            {
              "name": "responseWriter.WriteHeader"
            },
            {
              "name": "responseWriter.WriteString"
            },
            {
              "name": "roundRobinWriteScheduler.OpenStream"
            },
            {
              "name": "serverConn.CloseConn"
            },
            {
              "name": "serverConn.Flush"
            },
            {
              "name": "stickyErrWriter.Write"
            },
            {
              "name": "transportResponseBody.Close"
            },
            {
              "name": "transportResponseBody.Read"
            },
            {
              "name": "writeData.String"
            }
          ],
          "vendor": "golang.org/x/net",
          "versions": [
            {
              "lessThan": "0.23.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Bartek Nowotarski (https://nowotarski.info/)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request\u0027s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-01T17:10:07.754Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/65051"
        },
        {
          "url": "https://go.dev/cl/576155"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2687"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240419-0009/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/04/05/4"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/04/03/16"
        }
      ],
      "title": "HTTP/2 CONTINUATION flood in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2023-45288",
    "datePublished": "2024-04-04T20:37:30.714Z",
    "dateReserved": "2023-10-06T17:06:26.221Z",
    "dateUpdated": "2025-02-13T17:14:01.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9407 (GCVE-0-2024-9407)

Vulnerability from cvelistv5

Published

2024-10-01 20:13

Modified

2025-08-03 08:47

Severity ?

4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-20 - Improper Input Validation

Summary

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

References

►

URL

Tags

	https://access.redhat.com/errata/RHSA-2024:10147	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:8846	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9051	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9454	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9459	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:9926	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2024-9407	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2315887	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

►

Version: 0 ≤

		Version: 0 ≤
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020241023085649.afee755d < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 4:4.9.4-16.el9_4 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 4:5.2.2-9.el9_5 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.37.5-1.el9_5 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 2:1.33.11-1.el9_4 < * cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 416.94.202411201433-0 < * cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9407",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-01T20:38:18.374514Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-01T20:38:33.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-12-20T13:06:46.310Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241220-0010/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/containers/podman",
          "defaultStatus": "unaffected",
          "packageName": "podman",
          "versions": [
            {
              "lessThan": "5.2.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com/containers/buildah",
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "versions": [
            {
              "lessThan": "1.37.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020241023085649.afee755d",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:4.9.4-16.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:5.2.2-9.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.37.5-1.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.33.11-1.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "416.94.202411201433-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-docker-builder",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Erik Sj\u00f6lund (Upstream) for reporting this issue."
        }
      ],
      "datePublic": "2024-10-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-03T08:47:42.103Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:10147",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:10147"
        },
        {
          "name": "RHSA-2024:8846",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8846"
        },
        {
          "name": "RHSA-2024:9051",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9051"
        },
        {
          "name": "RHSA-2024:9454",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9454"
        },
        {
          "name": "RHSA-2024:9459",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9459"
        },
        {
          "name": "RHSA-2024:9926",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9926"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-9407"
        },
        {
          "name": "RHBZ#2315887",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315887"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-10-01T10:33:54.248000+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-10-01T00:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_redhatCweChain": "CWE-20: Improper Input Validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-9407",
    "datePublished": "2024-10-01T20:13:29.588Z",
    "dateReserved": "2024-10-01T10:55:34.838Z",
    "dateUpdated": "2025-08-03T08:47:42.103Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-11218 (GCVE-0-2024-11218)

Vulnerability from cvelistv5

Published

2025-01-22 04:55

Modified

2025-08-06 04:53

Severity ?

8.6 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-269 - Improper Privilege Management

Summary

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.

References

►

URL

Tags

	https://access.redhat.com/errata/RHSA-2025:0830	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:0878	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:0922	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:0923	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1186	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1187	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1188	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1189	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1207	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1275	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1295	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1296	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1372	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1453	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1707	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1713	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1908	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1910	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:1914	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2441	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2443	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2454	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2456	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2701	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2703	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2710	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:2712	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:3577	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:3798	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2024-11218	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2326231	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

►

Version: 0   ≤
Version: 1.35.0   ≤
Version: 1.37.0   ≤
Version: 1.38.0   ≤

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020250124120243.afee755d < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 8060020250203202123.3b538bd8 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 8060020250203202123.3b538bd8 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 8060020250203202123.3b538bd8 < * cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 8080020250207173112.0f77c1b7 < * cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 4:5.2.2-13.el9_5 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.37.6-1.el9_5 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 2:4.2.0-6.el9_0 < * cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 1:1.26.9-1.el9_0 < * cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 1:1.29.5-1.el9_2 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 2:4.4.1-22.el9_2 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 2:1.33.12-2.el9_4 < * cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 4:4.9.4-17.el9_4 < * cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 412.86.202503052321-0 < * cpe:/a:redhat:openshift:4.12::el8 cpe:/a:redhat:openshift:4.12::el9
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 3:4.4.1-9.rhaos4.12.el8 < * cpe:/a:redhat:openshift:4.12::el8 cpe:/a:redhat:openshift:4.12::el9
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 1:1.29.5-1.rhaos4.13.el9 < * cpe:/a:redhat:openshift:4.13::el9 cpe:/a:redhat:openshift:4.13::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 3:4.4.1-16.rhaos4.13.el8 < * cpe:/a:redhat:openshift:4.13::el9 cpe:/a:redhat:openshift:4.13::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 413.92.202503112237-0 < * cpe:/a:redhat:openshift:4.13::el9 cpe:/a:redhat:openshift:4.13::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 3:4.4.1-22.rhaos4.14.el9 < * cpe:/a:redhat:openshift:4.14::el9 cpe:/a:redhat:openshift:4.14::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 1:1.29.5-1.rhaos4.14.el9 < * cpe:/a:redhat:openshift:4.14::el9 cpe:/a:redhat:openshift:4.14::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 414.92.202503100617-0 < * cpe:/a:redhat:openshift:4.14::el9 cpe:/a:redhat:openshift:4.14::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 3:4.4.1-33.rhaos4.15.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 1:1.29.5-1.rhaos4.15.el9 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 415.92.202503060749-0 < * cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 4:4.9.4-15.rhaos4.16.el9 < * cpe:/a:redhat:openshift:4.16::el8 cpe:/a:redhat:openshift_ironic:4.16::el9 cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 2:1.33.12-1.rhaos4.16.el9 < * cpe:/a:redhat:openshift:4.16::el8 cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 416.94.202502180249-0 < * cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 5:5.2.2-2.rhaos4.17.el9 < * cpe:/a:redhat:openshift:4.17::el9 cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 2:1.33.12-1.rhaos4.17.el8 < * cpe:/a:redhat:openshift:4.17::el9 cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202504080421-0 < * cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 2:1.33.12-1.rhaos4.18.el9 < * cpe:/a:redhat:openshift:4.18::el9 cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 418.94.202504021150-0 < * cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11218",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-22T14:11:18.056703Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T17:08:25.061Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/containers/buildah",
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "versions": [
            {
              "lessThan": "1.33.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.35.5",
              "status": "affected",
              "version": "1.35.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.37.6",
              "status": "affected",
              "version": "1.37.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.38.1",
              "status": "affected",
              "version": "1.38.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020250124120243.afee755d",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/a:redhat:rhel_aus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020250203202123.3b538bd8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/a:redhat:rhel_aus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020250203202123.3b538bd8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/a:redhat:rhel_aus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020250203202123.3b538bd8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020250207173112.0f77c1b7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:5.2.2-13.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.37.6-1.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:4.2.0-6.el9_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.26.9-1.el9_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.29.5-1.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:4.4.1-22.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.33.12-2.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:4.9.4-17.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.12::el8",
            "cpe:/a:redhat:openshift:4.12::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.12",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "412.86.202503052321-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.12::el8",
            "cpe:/a:redhat:openshift:4.12::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.12",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-9.rhaos4.12.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.29.5-1.rhaos4.13.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-16.rhaos4.13.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "413.92.202503112237-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9",
            "cpe:/a:redhat:openshift:4.14::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-22.rhaos4.14.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9",
            "cpe:/a:redhat:openshift:4.14::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.29.5-1.rhaos4.14.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el9",
            "cpe:/a:redhat:openshift:4.14::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "414.92.202503100617-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-33.rhaos4.15.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.29.5-1.rhaos4.15.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "415.92.202503060749-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el8",
            "cpe:/a:redhat:openshift_ironic:4.16::el9",
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:4.9.4-15.rhaos4.16.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el8",
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.33.12-1.rhaos4.16.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.16::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "416.94.202502180249-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9",
            "cpe:/a:redhat:openshift:4.17::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "5:5.2.2-2.rhaos4.17.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9",
            "cpe:/a:redhat:openshift:4.17::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.33.12-1.rhaos4.17.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.17::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.17",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "417.94.202504080421-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9",
            "cpe:/a:redhat:openshift:4.18::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:1.33.12-1.rhaos4.18.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.18::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4.18",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "418.94.202504021150-0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-01-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-06T04:53:58.659Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2025:0830",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:0830"
        },
        {
          "name": "RHSA-2025:0878",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:0878"
        },
        {
          "name": "RHSA-2025:0922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:0922"
        },
        {
          "name": "RHSA-2025:0923",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:0923"
        },
        {
          "name": "RHSA-2025:1186",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1186"
        },
        {
          "name": "RHSA-2025:1187",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1187"
        },
        {
          "name": "RHSA-2025:1188",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1188"
        },
        {
          "name": "RHSA-2025:1189",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1189"
        },
        {
          "name": "RHSA-2025:1207",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1207"
        },
        {
          "name": "RHSA-2025:1275",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1275"
        },
        {
          "name": "RHSA-2025:1295",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1295"
        },
        {
          "name": "RHSA-2025:1296",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1296"
        },
        {
          "name": "RHSA-2025:1372",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1372"
        },
        {
          "name": "RHSA-2025:1453",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1453"
        },
        {
          "name": "RHSA-2025:1707",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1707"
        },
        {
          "name": "RHSA-2025:1713",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1713"
        },
        {
          "name": "RHSA-2025:1908",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1908"
        },
        {
          "name": "RHSA-2025:1910",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1910"
        },
        {
          "name": "RHSA-2025:1914",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:1914"
        },
        {
          "name": "RHSA-2025:2441",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2441"
        },
        {
          "name": "RHSA-2025:2443",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2443"
        },
        {
          "name": "RHSA-2025:2454",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2454"
        },
        {
          "name": "RHSA-2025:2456",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2456"
        },
        {
          "name": "RHSA-2025:2701",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2701"
        },
        {
          "name": "RHSA-2025:2703",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2703"
        },
        {
          "name": "RHSA-2025:2710",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2710"
        },
        {
          "name": "RHSA-2025:2712",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2712"
        },
        {
          "name": "RHSA-2025:3577",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:3577"
        },
        {
          "name": "RHSA-2025:3798",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:3798"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-11218"
        },
        {
          "name": "RHBZ#2326231",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2326231"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-11-14T13:05:29.849000+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-01-20T00:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mandatory access controls should limit the access of the process performing the build, on systems where they are enabled.\n\nSELinux enforces strict access controls by confining the build process (e.g., Podman) to specific domains like container_t. This prevents unauthorized access to sensitive host files and directories, even if a malicious Containerfile tries to exploit the --mount flag."
        }
      ],
      "x_redhatCweChain": "CWE-269: Improper Privilege Management"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-11218",
    "datePublished": "2025-01-22T04:55:30.649Z",
    "dateReserved": "2024-11-14T13:11:49.476Z",
    "dateUpdated": "2025-08-06T04:53:58.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

suse-su-2025:20279-1

Vulnerability from csaf_suse

CVE-2024-1753 (GCVE-0-2024-1753)

Vulnerability from cvelistv5

CVE-2024-3727 (GCVE-0-2024-3727)

Vulnerability from cvelistv5

CVE-2025-22869 (GCVE-0-2025-22869)

Vulnerability from cvelistv5

CVE-2025-27144 (GCVE-0-2025-27144)

Vulnerability from cvelistv5

CVE-2023-45288 (GCVE-0-2023-45288)

Vulnerability from cvelistv5

CVE-2024-9407 (GCVE-0-2024-9407)

Vulnerability from cvelistv5

CVE-2024-11218 (GCVE-0-2024-11218)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature