CVE-2024-3727

Containers/image: digest type does not guarantee valid type

Published May 9, 2024 CVSS 3.1 · 8.3 High EPSS 1.3% KEV · Not listed
Description
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-1469 A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
Github GHSA Github GHSA GHSA-6wvf-f2vw-3425 github.com/containers/image allows unexpected authenticated registry accesses
References
Link Providers
https://access.redhat.com/errata/RHSA-2024:0045 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:3718 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:4159 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:4613 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:4850 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:4960 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:5258 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:5951 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:6054 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:6122 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:6708 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:6818 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:6824 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:7164 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:7174 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:7182 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:7187 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:7922 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:7941 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:8260 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:8425 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:9097 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:9098 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:9102 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:9960 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2024-3727 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2274767 cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4HEYS34N55G7NOQZKNEXZKQVNDGEICCD/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6B37TXOKTKDBE2V26X2NSP7JKNMZOFVP/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYT3D2P3OJKISNFKOOHGY6HCUCQZYAVR/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLND3YDQQRWVRIUPL2G5UKXP5L3VSBBT/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DTOMYERG5ND4QFDHC4ZSGCED3T3ESRSC/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FBZQ2ZRMFEUQ35235B2HWPSXGDCBZHFV/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QFXMF3VVKIZN7ZMB7PKZCSWV6MOMTGMQ/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFVSMR7TNLO2KPWJSW4CF64C2QMQXCIN/ cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-3727 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-3727 cve-icon
History
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
cpe:/a:redhat:enterprise_linux:10
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_devspaces:3: cpe:/a:redhat:openshift_devspaces:3
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10
Type Values Removed Values Added
CPEs cpe:/a:redhat:assisted_installer: cpe:/a:redhat:assisted_installer:1
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.18::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_devspaces:3:: cpe:/a:redhat:openshift_devspaces:3:
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_devspaces:3::el8 cpe:/a:redhat:openshift_devspaces:3::
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_api_data_protection:1
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_api_data_protection:1.3::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:9
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.13::el8
cpe:/a:redhat:openshift:4.13::el9
cpe:/a:redhat:openshift_ironic:4.13::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_ironic:4.14::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.17::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhmt cpe:/a:redhat:rhmt:1.8::el8
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:advanced_cluster_security:4.5::el8
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:advanced_cluster_security:4 cpe:/a:redhat:advanced_cluster_security:4.4::el8
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:container_native_virtualization:4.15::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::appstream
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.14::el8
cpe:/a:redhat:openshift:4.14::el9
References