A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podmanUpgrade libslirp-develUpgrade skopeo-testsUpgrade aardvark-dnsUpgrade runcUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade skopeoUpgrade containers-commonUpgrade podman-remoteUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade criu-develUpgrade critUpgrade netavarkUpgrade buildah-testsUpgrade container-selinuxUpgrade cockpit-podmanUpgrade criuUpgrade conmonUpgrade podman-testsUpgrade crunUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade libslirpUpgrade buildahUpgrade toolboxUpgrade python3-podmanUpgrade toolbox-testsUpgrade slirp4netnsUpgrade udicaUpgrade podman-dockerUpgrade podman-gvproxy | Oct 16, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | Upgrade golang-github-containers-common | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade podman-pluginsUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade skopeo-testsUpgrade criu-libsUpgrade crunUpgrade conmonUpgrade container-selinuxUpgrade skopeoUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade criu-develUpgrade libslirp-develUpgrade slirp4netnsUpgrade podman-dockerUpgrade podman-testsUpgrade criuUpgrade buildah-testsUpgrade buildahUpgrade podman-remoteUpgrade podman-gvproxyUpgrade libslirpUpgrade netavarkUpgrade runcUpgrade critUpgrade cockpit-podmanUpgrade podmanUpgrade aardvark-dnsUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade python3-podman | Oct 16, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade cri-oUpgrade rhcos | Oct 17, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade conmon-debuginfoUpgrade libslirp-debuginfoUpgrade crun-debuginfoUpgrade podman-gvproxyUpgrade criu-debuginfoUpgrade conmon-debugsourceUpgrade container-selinuxUpgrade fuse-overlayfsUpgrade toolbox-debuginfoUpgrade buildahUpgrade buildah-debuginfoUpgrade podman-dockerUpgrade slirp4netnsUpgrade runc-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade buildah-tests-debuginfoUpgrade libslirpUpgrade python3-criuUpgrade toolbox-testsUpgrade aardvark-dnsUpgrade cockpit-podmanUpgrade udicaUpgrade criu-debugsourceUpgrade podman-plugins-debuginfoUpgrade buildah-testsUpgrade criuUpgrade podman-testsUpgrade containernetworking-plugins-debuginfoUpgrade conmonUpgrade crun-debugsourceUpgrade libslirp-debugsourceUpgrade podman-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-pluginsUpgrade podman-debugsourceUpgrade podman-catatonitUpgrade criu-develUpgrade fuse-overlayfs-debugsourceUpgrade criu-libsUpgrade toolbox-debugsourceUpgrade crunUpgrade slirp4netns-debuginfoUpgrade podman-remote-debuginfoUpgrade critUpgrade libslirp-develUpgrade netavarkUpgrade oci-seccomp-bpf-hookUpgrade python3-podmanUpgrade containernetworking-plugins-debugsourceUpgrade toolboxUpgrade runcUpgrade podman-catatonit-debuginfoUpgrade containers-commonUpgrade skopeoUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade slirp4netns-debugsourceUpgrade podmanUpgrade buildah-debugsourceUpgrade criu-libs-debuginfoUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfo | Oct 16, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade buildah-debuginfoUpgrade buildahUpgrade podman-catatonitUpgrade containers-commonUpgrade criu-debugsourceUpgrade buildah-tests-debuginfoUpgrade toolboxUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade podman-catatonit-debuginfoUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade conmon-debugsourceUpgrade criu-debuginfoUpgrade netavarkUpgrade podmanUpgrade conmonUpgrade runc-debugsourceUpgrade toolbox-testsUpgrade aardvark-dnsUpgrade criuUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade libslirpUpgrade skopeoUpgrade containernetworking-plugins-debugsourceUpgrade crun-debugsourceUpgrade podman-pluginsUpgrade libslirp-debuginfoUpgrade toolbox-debuginfoUpgrade podman-debugsourceUpgrade podman-remote-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade criu-develUpgrade python3-criuUpgrade podman-testsUpgrade crunUpgrade slirp4netns-debugsourceUpgrade runcUpgrade buildah-debugsourceUpgrade skopeo-testsUpgrade podman-gvproxy-debuginfoUpgrade runc-debuginfoUpgrade podman-gvproxyUpgrade toolbox-debugsourceUpgrade slirp4netnsUpgrade podman-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade critUpgrade conmon-debuginfoUpgrade slirp4netns-debuginfoUpgrade podman-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debuginfoUpgrade podman-remoteUpgrade libslirp-develUpgrade libslirp-debugsource | Nov 4, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade govulncheck-vulndbUpgrade podman-remoteUpgrade podmanshUpgrade buildahUpgrade podmanUpgrade podman-docker | Dec 31, 2024 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub