Red Hat Podman/Buildah CVE-2024-9676 Symlink Traversal Vulnerability Advisory

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: CVE-2024-9676 2. Public Disclosure Date: October 15, 2024 3. Last Modified Date: October 15, 2024 4. Severity: Medium 5. Description: A symbolic link traversal vulnerability in container/storage components of Podman, Buildah, and CRI-O, which may cause Podman, Buildah, and CRI-O to hang, and result in a denial-of-service (DoS) via OOM kill. The vulnerability allows attackers to run malicious images in Podman and Buildah using automatically assigned user namespaces ( ), enabling them to read the file within the container, and potentially read arbitrary files on the host from the container/storage. 6. Additional Information: - Bugzilla ID: 2317467 - CWE ID: 22 - FAQ: Frequently Asked Questions about CVE-2024-9676 7. Affected Packages and Red Hat Security Patches: - OpenShift Developer Tools and Services - Red Hat Enterprise Linux 7 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 - skopeo - podman - buildah - container-tools:rhel8/buildah - container-tools:rhel8/podman - container-tools:rhel8/skopeo 8. CVSS v3 Score: - CVSS v3 Base Score: 6.5 - CVSS v3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 9. FAQs: - Why does Red Hat’s CVSS v3 score or impact differ from other vendors? - My product is listed as “under investigation” or “affected.” When will Red Hat release a fix? - If my product is listed as “not fixed,” what should I do? - If my product is listed as “fix delayed,” what should I do? - What are mitigations? - I have a Red Hat product, but it’s not listed above. Is it affected? - Why does my security scanner report that my product is affected by this vulnerability, even though my product version is patched or not affected? - My product is listed as “out of support.” What does this mean? This information provides a detailed description of the CVE-2024-9676 vulnerability, affected packages, CVSS scoring, and frequently asked questions.

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat Podman/Buildah CVE-2024-9676 Symlink Traversal Vulnerability Advisory

More from this source