A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
CVSS Details
- CVSS 3.1 Base Score: 8.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-remoteUpgrade criu-libsUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-pluginsUpgrade conmonUpgrade containers-commonUpgrade skopeo-testsUpgrade netavarkUpgrade toolboxUpgrade crunUpgrade python3-podmanUpgrade podman-pluginsUpgrade podmanUpgrade runcUpgrade skopeoUpgrade criu-develUpgrade buildahUpgrade criuUpgrade podman-testsUpgrade container-selinuxUpgrade podman-catatonitUpgrade udicaUpgrade critUpgrade aardvark-dnsUpgrade python3-criuUpgrade podman-gvproxyUpgrade fuse-overlayfsUpgrade slirp4netnsUpgrade libslirpUpgrade cockpit-podmanUpgrade toolbox-testsUpgrade buildah-testsUpgrade podman-docker | Aug 15, 2024 | May 14, 2024 |
| Alpine Linux | — | Upgrade skopeoUpgrade podmanUpgrade buildah | Aug 22, 2024 | May 9, 2024 |
| Debian | — | Upgrade golang-github-containers-imageNo solution exists | May 15, 2025 | May 14, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Dec 19, 2024 |
| Oracle_linux | — | Upgrade buildah-testsUpgrade containernetworking-pluginsUpgrade runcUpgrade slirp4netnsUpgrade libslirp-develUpgrade udicaUpgrade cockpit-podmanUpgrade critUpgrade container-selinuxUpgrade containers-commonUpgrade buildahUpgrade podman-remoteUpgrade podman-dockerUpgrade python3-criuUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade netavarkUpgrade libslirpUpgrade oci-seccomp-bpf-hookUpgrade skopeo-testsUpgrade podman-pluginsUpgrade conmonUpgrade podmanUpgrade criu-libsUpgrade crunUpgrade python3-podmanUpgrade criuUpgrade fuse-overlayfsUpgrade podman-testsUpgrade criu-develUpgrade podman-catatonitUpgrade skopeo | Oct 16, 2024 | May 9, 2024 |
| Redhat Openshift | — | Upgrade cri-oUpgrade rhcosUpgrade podmanUpgrade skopeo | Jun 28, 2024 | May 9, 2024 |
| Redhat_linux | — | Upgrade libslirp-debuginfoUpgrade container-selinuxUpgrade podman-pluginsUpgrade python3-criuUpgrade criu-develUpgrade toolbox-debugsourceUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-dockerUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade runc-debuginfoUpgrade conmon-debuginfoUpgrade crunUpgrade podman-debuginfoUpgrade podman-remote-debuginfoUpgrade cockpit-podmanUpgrade skopeo-testsNo solution existsUpgrade containernetworking-plugins-debuginfoUpgrade critUpgrade podman-plugins-debuginfoUpgrade toolbox-debuginfoUpgrade criu-libs-debuginfoUpgrade libslirp-debugsourceUpgrade crun-debugsourceUpgrade runc-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-remoteUpgrade udicaUpgrade containernetworking-pluginsUpgrade runcUpgrade podman-debugsourceUpgrade slirp4netns-debugsourceUpgrade podmanUpgrade python3-podmanUpgrade slirp4netnsUpgrade podman-catatonitUpgrade aardvark-dnsUpgrade libslirpUpgrade skopeo-debugsourceUpgrade netavarkUpgrade buildah-tests-debuginfoUpgrade criu-libsUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonit-debuginfoUpgrade libslirp-develUpgrade conmon-debugsourceUpgrade skopeoUpgrade toolbox-testsUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade criu-debuginfoUpgrade buildah-debugsourceUpgrade podman-testsUpgrade criuUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade containers-commonUpgrade crun-debuginfoUpgrade buildahUpgrade oci-seccomp-bpf-hookUpgrade toolboxUpgrade skopeo-debuginfoUpgrade buildah-debuginfoUpgrade buildah-tests | Sep 13, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade python3-criuUpgrade toolbox-debugsourceUpgrade criu-debuginfoUpgrade crun-debugsourceUpgrade podman-debugsourceUpgrade libslirp-debugsourceUpgrade conmon-debuginfoUpgrade containers-commonUpgrade podman-debuginfoUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade toolbox-debuginfoUpgrade buildahUpgrade toolbox-testsUpgrade aardvark-dnsUpgrade runc-debugsourceUpgrade criu-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade podman-remoteUpgrade runcUpgrade slirp4netns-debuginfoUpgrade buildah-testsUpgrade libslirp-debuginfoUpgrade criu-libs-debuginfoUpgrade buildah-debuginfoUpgrade buildah-tests-debuginfoUpgrade critUpgrade criu-libsUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade criuUpgrade toolboxUpgrade libslirpUpgrade slirp4netnsUpgrade podman-catatonit-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade crun-debuginfoUpgrade podman-catatonitUpgrade skopeo-testsUpgrade podman-pluginsUpgrade podman-testsUpgrade podman-remote-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade runc-debuginfoUpgrade criu-develUpgrade podman-gvproxyUpgrade podmanUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade netavarkUpgrade crunUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netns-debugsourceUpgrade fuse-overlayfsUpgrade buildah-debugsourceUpgrade skopeoUpgrade conmon-debugsourceUpgrade conmonUpgrade containernetworking-plugins-debuginfo | Aug 22, 2024 | May 14, 2024 |
| Suse | — | Upgrade docker-rootless-extrasUpgrade podman-remoteUpgrade apptainer-leapUpgrade skopeoUpgrade skopeo-fish-completionUpgrade warewulf4Upgrade containerized-data-importer-controllerUpgrade dockerUpgrade podmanUpgrade podman-cni-configUpgrade podmanshUpgrade squashfuse-toolsUpgrade warewulf4-overlayUpgrade govulncheck-vulndbUpgrade docker-bash-completionUpgrade containerized-data-importer-apiUpgrade docker-fish-completionUpgrade squashfuse-develUpgrade obs-service-cdi_containers_metaUpgrade skopeo-bash-completionUpgrade containerized-data-importer-importerUpgrade containerized-data-importer-uploadproxyUpgrade buildahUpgrade warewulf4-overlay-slurmUpgrade apptainer-sle15_5Upgrade podman-dockerUpgrade docker-zsh-completionUpgrade squashfuseUpgrade libsquashfuse0Upgrade skopeo-zsh-completionUpgrade containerized-data-importer-clonerUpgrade apptainer-sle15_6Upgrade warewulf4-manUpgrade containerized-data-importer-uploadserverUpgrade apptainerUpgrade containerized-data-importer-operatorUpgrade containerized-data-importer-manifests | May 30, 2024 | May 14, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub