Skip to content
fr Sign in
8.3 High

CVE-2024-3727 Containers/image: digest type does not guarantee valid type

Description

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
High
Privileges required
None
Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Affected products and versions

Product Affected versions Fixed in
OADP-1.3-RHEL-9 1.3 earliest → < 1.3.4-9 1.3.4-9
Red Hat Advanced Cluster Security 4.4 4.4 earliest → < 4.4.5-3 4.4.5-3
Red Hat Advanced Cluster Security 4.5 4.5 earliest → < 4.5.2-2 4.5.2-2
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Migration Toolkit for Containers 1.8 1.8 earliest → < 1.8.4-22 1.8.4-22
Red Hat OpenShift Container Platform 4.13 Versions not published
Red Hat OpenShift Container Platform 4.14 Versions not published
Red Hat OpenShift Container Platform 4.15 415.92 earliest → < 415.92.202409162258-0 415.92.202409162258-0
Show the 22 other branches
Product Affected versions Fixed in
Red Hat OpenShift Container Platform 4.16 4.16 earliest → < 4.16.0-202410172201.p0.gb121e87.assembly.stream.el9 4.16.0-202410172201.p0.gb121e87.assembly.stream.el9
Red Hat OpenShift Container Platform 4.17 4.17 earliest → < 4.17.0-202410022234.p0.gfbc55c6.assembly.stream.el9 4.17.0-202410022234.p0.gfbc55c6.assembly.stream.el9
Red Hat OpenShift Container Platform 4.18 4.18 earliest → < 4.18.0-202502060238.p0.g73d65db.assembly.stream.el9 4.18.0-202502060238.p0.g73d65db.assembly.stream.el9
RHEL-9-CNV-4.15 4.15 earliest → < 4.15.5-7 4.15.5-7
Multicluster Engine for Kubernetes Versions not published
OpenShift Developer Tools and Services Versions not published
OpenShift Serverless Versions not published
OpenShift Source-to-Image (S2I) Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Advanced Cluster Security 3 Versions not published
Red Hat Ansible Automation Platform 1.2 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat OpenShift Container Platform 3.11 Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat OpenShift Container Platform Assisted Installer 1 Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat Openshift sandboxed containers Versions not published
Red Hat OpenShift Virtualization 4 Versions not published
Red Hat OpenStack Platform 16.2 Versions not published
Red Hat Quay 3 Versions not published

References

Timeline

  1. Published
  2. Last modified
Track this CVE