A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
CVSS Details
- CVSS 3.1 Base Score: 8.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade toolbox-testsUpgrade udicaUpgrade container-selinuxUpgrade podman-testsUpgrade critUpgrade podman-catatonitUpgrade criuUpgrade libslirpUpgrade buildah-testsUpgrade podman-dockerUpgrade python3-criuUpgrade slirp4netnsUpgrade buildahUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade criu-develUpgrade skopeo-testsUpgrade podman-remoteUpgrade containers-commonUpgrade criu-libsUpgrade crunUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade toolboxUpgrade podman-pluginsUpgrade runcUpgrade podmanUpgrade libslirp-develUpgrade python3-podmanUpgrade netavarkUpgrade containernetworking-pluginsUpgrade conmon | Aug 15, 2024 | May 14, 2024 |
| Alpine Linux | — | Upgrade buildahUpgrade podmanUpgrade skopeo | Aug 22, 2024 | May 9, 2024 |
| Debian | — | Upgrade golang-github-containers-image | May 15, 2025 | May 14, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Dec 19, 2024 |
| Oracle_linux | — | Upgrade libslirp-develUpgrade critUpgrade udicaUpgrade cockpit-podmanUpgrade python3-criuUpgrade aardvark-dnsUpgrade podman-dockerUpgrade podman-gvproxyUpgrade podman-remoteUpgrade buildahUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade runcUpgrade container-selinuxUpgrade containers-commonUpgrade slirp4netnsUpgrade conmonUpgrade podman-pluginsUpgrade criu-develUpgrade python3-podmanUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonitUpgrade skopeoUpgrade crunUpgrade criuUpgrade podman-testsUpgrade skopeo-testsUpgrade criu-libsUpgrade podmanUpgrade libslirpUpgrade fuse-overlayfsUpgrade netavark | Oct 16, 2024 | May 9, 2024 |
| Redhat Openshift | — | Upgrade rhcosUpgrade cri-oUpgrade podmanUpgrade skopeo | Jun 28, 2024 | May 9, 2024 |
| Redhat_linux | — | Upgrade libslirpUpgrade podman-catatonit-debuginfoUpgrade buildah-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-debugsourceUpgrade criuUpgrade conmonUpgrade criu-debuginfoUpgrade netavarkUpgrade fuse-overlayfs-debugsourceUpgrade podman-testsUpgrade skopeoUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade buildah-tests-debuginfoUpgrade conmon-debugsourceUpgrade buildah-testsUpgrade podman-gvproxyUpgrade toolbox-testsUpgrade buildahUpgrade crun-debuginfoUpgrade toolboxUpgrade containers-commonUpgrade slirp4netnsUpgrade aardvark-dnsUpgrade skopeo-debuginfoUpgrade buildah-debuginfoUpgrade criu-libsUpgrade python3-podmanUpgrade podmanUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade skopeo-testsUpgrade udicaUpgrade podman-remote-debuginfoUpgrade podman-debuginfoNo solution existsUpgrade criu-develUpgrade podman-pluginsUpgrade libslirp-debuginfoUpgrade container-selinuxUpgrade toolbox-debugsourceUpgrade python3-criuUpgrade cockpit-podmanUpgrade toolbox-debuginfoUpgrade crun-debugsourceUpgrade runc-debugsourceUpgrade critUpgrade podman-gvproxy-debuginfoUpgrade containernetworking-pluginsUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade criu-debugsourceUpgrade conmon-debuginfoUpgrade slirp4netns-debuginfoUpgrade criu-libs-debuginfoUpgrade runc-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade crunUpgrade runcUpgrade podman-remoteUpgrade podman-dockerUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-debugsourceUpgrade podman-plugins-debuginfo | Sep 13, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade podman-gvproxy-debuginfoUpgrade toolbox-debugsourceUpgrade podman-remoteUpgrade criu-libs-debuginfoUpgrade containers-commonUpgrade podman-debugsourceUpgrade conmon-debuginfoUpgrade toolbox-testsUpgrade runc-debugsourceUpgrade podman-debuginfoUpgrade aardvark-dnsUpgrade buildahUpgrade crun-debugsourceUpgrade criu-debuginfoUpgrade criu-debugsourceUpgrade libslirp-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade slirp4netns-debuginfoUpgrade podman-plugins-debuginfoUpgrade runcUpgrade critUpgrade libslirp-debuginfoUpgrade buildah-debuginfoUpgrade buildah-testsUpgrade buildah-tests-debuginfoUpgrade criu-libsUpgrade toolbox-debuginfoUpgrade netavarkUpgrade podman-gvproxyUpgrade slirp4netns-debugsourceUpgrade podman-testsUpgrade criuUpgrade podmanUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crunUpgrade containernetworking-plugins-debugsourceUpgrade podman-remote-debuginfoUpgrade fuse-overlayfsUpgrade skopeo-testsUpgrade podman-catatonitUpgrade crun-debuginfoUpgrade podman-pluginsUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netnsUpgrade libslirpUpgrade podman-catatonit-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade criu-develUpgrade runc-debuginfoUpgrade toolboxUpgrade skopeoUpgrade conmon-debugsourceUpgrade conmonUpgrade buildah-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfo | Aug 22, 2024 | May 14, 2024 |
| Suse | — | Upgrade squashfuseUpgrade skopeo-bash-completionUpgrade docker-zsh-completionUpgrade buildahUpgrade containerized-data-importer-operatorUpgrade containerized-data-importer-uploadserverUpgrade warewulf4-manUpgrade apptainerUpgrade libsquashfuse0Upgrade apptainer-sle15_5Upgrade containerized-data-importer-importerUpgrade warewulf4-overlay-slurmUpgrade skopeo-zsh-completionUpgrade containerized-data-importer-uploadproxyUpgrade apptainer-sle15_6Upgrade containerized-data-importer-clonerUpgrade podman-dockerUpgrade containerized-data-importer-manifestsUpgrade docker-bash-completionUpgrade squashfuse-develUpgrade podmanshUpgrade obs-service-cdi_containers_metaUpgrade containerized-data-importer-controllerUpgrade warewulf4Upgrade skopeoUpgrade dockerUpgrade warewulf4-overlayUpgrade docker-fish-completionUpgrade squashfuse-toolsUpgrade govulncheck-vulndbUpgrade containerized-data-importer-apiUpgrade podmanUpgrade docker-rootless-extrasUpgrade apptainer-leapUpgrade podman-remoteUpgrade podman-cni-configUpgrade skopeo-fish-completion | May 30, 2024 | May 14, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub