A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
CVSS Details
- CVSS 3.1 Base Score: 8.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirpUpgrade python3-criuUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade criuUpgrade container-selinuxUpgrade podman-testsUpgrade toolbox-testsUpgrade slirp4netnsUpgrade podman-dockerUpgrade cockpit-podmanUpgrade podman-catatonitUpgrade udicaUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade critUpgrade buildahUpgrade runcUpgrade podman-pluginsUpgrade criu-libsUpgrade podman-remoteUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade python3-podmanUpgrade crunUpgrade toolboxUpgrade netavarkUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade podmanUpgrade skopeo-testsUpgrade skopeoUpgrade criu-devel | Aug 15, 2024 | May 14, 2024 |
| Alpine Linux | — | Upgrade skopeoUpgrade podmanUpgrade buildah | Aug 22, 2024 | May 9, 2024 |
| Debian | — | Upgrade golang-github-containers-image | May 15, 2025 | May 14, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Dec 19, 2024 |
| Oracle_linux | — | Upgrade containers-commonUpgrade runcUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade cockpit-podmanUpgrade buildahUpgrade slirp4netnsUpgrade container-selinuxUpgrade critUpgrade libslirp-develUpgrade udicaUpgrade aardvark-dnsUpgrade podman-dockerUpgrade podman-gvproxyUpgrade podman-remoteUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade python3-podmanUpgrade libslirpUpgrade fuse-overlayfsUpgrade criu-libsUpgrade criu-develUpgrade podman-testsUpgrade crunUpgrade netavarkUpgrade criuUpgrade skopeo-testsUpgrade conmonUpgrade podman-pluginsUpgrade skopeoUpgrade podman-catatonitUpgrade podman | Oct 16, 2024 | May 9, 2024 |
| Redhat Openshift | — | Upgrade rhcosUpgrade cri-oUpgrade skopeoUpgrade podman | Jun 28, 2024 | May 9, 2024 |
| Redhat_linux | — | Upgrade containernetworking-plugins-debuginfoUpgrade libslirp-debuginfoUpgrade container-selinuxUpgrade toolbox-debuginfoUpgrade podman-debugsourceUpgrade cockpit-podmanUpgrade toolbox-debugsourceUpgrade critUpgrade runc-debugsourceUpgrade runc-debuginfoUpgrade conmon-debuginfoUpgrade crunUpgrade slirp4netns-debuginfoUpgrade criu-libs-debuginfoUpgrade python3-criuUpgrade podman-pluginsUpgrade podman-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade runcUpgrade podman-remoteUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-pluginsUpgrade criu-debugsourceNo solution existsUpgrade udicaUpgrade criu-develUpgrade podman-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-debugsourceUpgrade podman-dockerUpgrade skopeo-testsUpgrade podman-remote-debuginfoUpgrade crun-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade crun-debuginfoUpgrade buildah-testsUpgrade conmonUpgrade podman-gvproxyUpgrade containers-commonUpgrade aardvark-dnsUpgrade buildah-debugsourceUpgrade toolbox-testsUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade skopeo-debugsourceUpgrade netavarkUpgrade criu-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade criuUpgrade podman-testsUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade python3-podmanUpgrade podmanUpgrade libslirpUpgrade conmon-debugsourceUpgrade toolboxUpgrade slirp4netnsUpgrade criu-libsUpgrade buildah-debuginfoUpgrade skopeo-debuginfoUpgrade podman-catatonit-debuginfoUpgrade buildahUpgrade skopeo | Sep 13, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade runcUpgrade buildah-testsUpgrade podman-gvproxy-debuginfoUpgrade buildah-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criu-libs-debuginfoUpgrade crun-debugsourceUpgrade libslirp-debugsourceUpgrade criu-debuginfoUpgrade runc-debugsourceUpgrade toolbox-testsUpgrade containernetworking-pluginsUpgrade toolbox-debuginfoUpgrade libslirp-develUpgrade conmon-debuginfoUpgrade containers-commonUpgrade criu-libsUpgrade podman-debuginfoUpgrade buildahUpgrade podman-plugins-debuginfoUpgrade toolbox-debugsourceUpgrade critUpgrade python3-criuUpgrade criu-debugsourceUpgrade libslirp-debuginfoUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-remoteUpgrade podman-debugsourceUpgrade aardvark-dnsUpgrade crunUpgrade podman-gvproxyUpgrade conmon-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade skopeoUpgrade criuUpgrade conmonUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-develUpgrade buildah-debugsourceUpgrade runc-debuginfoUpgrade skopeo-testsUpgrade podman-pluginsUpgrade slirp4netns-debugsourceUpgrade fuse-overlayfsUpgrade libslirpUpgrade podman-catatonit-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade toolboxUpgrade slirp4netnsUpgrade podman-testsUpgrade podman-remote-debuginfoUpgrade crun-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-catatonitUpgrade podmanUpgrade netavark | Aug 22, 2024 | May 14, 2024 |
| Suse | — | Upgrade containerized-data-importer-clonerUpgrade buildahUpgrade apptainer-sle15_6Upgrade containerized-data-importer-operatorUpgrade containerized-data-importer-manifestsUpgrade skopeo-zsh-completionUpgrade apptainer-sle15_5Upgrade warewulf4-manUpgrade containerized-data-importer-importerUpgrade docker-zsh-completionUpgrade skopeo-bash-completionUpgrade squashfuseUpgrade podman-dockerUpgrade libsquashfuse0Upgrade apptainerUpgrade containerized-data-importer-uploadserverUpgrade warewulf4-overlay-slurmUpgrade containerized-data-importer-uploadproxyUpgrade skopeo-fish-completionUpgrade squashfuse-toolsUpgrade squashfuse-develUpgrade podmanshUpgrade docker-bash-completionUpgrade govulncheck-vulndbUpgrade containerized-data-importer-apiUpgrade docker-fish-completionUpgrade apptainer-leapUpgrade podmanUpgrade docker-rootless-extrasUpgrade podman-remoteUpgrade podman-cni-configUpgrade obs-service-cdi_containers_metaUpgrade warewulf4-overlayUpgrade dockerUpgrade containerized-data-importer-controllerUpgrade skopeoUpgrade warewulf4 | May 30, 2024 | May 14, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub