A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
CVSS Details
- CVSS 3.1 Base Score: 8.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade containernetworking-pluginsUpgrade podmanUpgrade podman-remoteUpgrade skopeoUpgrade conmonUpgrade oci-seccomp-bpf-hookUpgrade libslirp-develUpgrade netavarkUpgrade containers-commonUpgrade crunUpgrade runcUpgrade podman-pluginsUpgrade skopeo-testsUpgrade toolboxUpgrade criu-develUpgrade python3-podmanUpgrade criu-libsUpgrade podman-dockerUpgrade buildah-testsUpgrade buildahUpgrade libslirpUpgrade cockpit-podmanUpgrade criuUpgrade podman-testsUpgrade podman-gvproxyUpgrade toolbox-testsUpgrade udicaUpgrade container-selinuxUpgrade slirp4netnsUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade aardvark-dnsUpgrade critUpgrade python3-criu | Aug 15, 2024 | May 14, 2024 |
| Alpine Linux | — | Upgrade podmanUpgrade buildahUpgrade skopeo | Aug 22, 2024 | May 9, 2024 |
| Debian | — | Upgrade golang-github-containers-imageNo solution exists | May 15, 2025 | May 14, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Dec 19, 2024 |
| Oracle_linux | — | Upgrade buildah-testsUpgrade runcUpgrade buildahUpgrade aardvark-dnsUpgrade podman-dockerUpgrade podman-remoteUpgrade podman-gvproxyUpgrade containers-commonUpgrade python3-criuUpgrade slirp4netnsUpgrade container-selinuxUpgrade libslirp-develUpgrade critUpgrade udicaUpgrade cockpit-podmanUpgrade containernetworking-pluginsUpgrade criuUpgrade fuse-overlayfsUpgrade netavarkUpgrade crunUpgrade podmanUpgrade libslirpUpgrade criu-libsUpgrade python3-podmanUpgrade skopeoUpgrade podman-pluginsUpgrade podman-catatonitUpgrade conmonUpgrade oci-seccomp-bpf-hookUpgrade skopeo-testsUpgrade podman-testsUpgrade criu-devel | Oct 16, 2024 | May 9, 2024 |
| Redhat Openshift | — | Upgrade cri-oUpgrade rhcosUpgrade skopeoUpgrade podman | Jun 28, 2024 | May 9, 2024 |
| Redhat_linux | — | Upgrade podman-testsUpgrade fuse-overlayfs-debugsourceUpgrade netavarkUpgrade conmonUpgrade toolboxUpgrade aardvark-dnsUpgrade criu-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade skopeo-debugsourceUpgrade criuUpgrade toolbox-testsUpgrade criu-libsUpgrade buildah-testsUpgrade podman-gvproxyUpgrade containers-commonUpgrade buildah-debugsourceUpgrade skopeo-debuginfoUpgrade buildah-debuginfoUpgrade podman-catatonit-debuginfoUpgrade libslirpUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade podmanUpgrade python3-podmanUpgrade buildah-tests-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade conmon-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade skopeoUpgrade libslirp-develUpgrade crun-debuginfoUpgrade slirp4netnsUpgrade slirp4netns-debugsourceUpgrade libslirp-debuginfoUpgrade critUpgrade runcUpgrade podman-remoteUpgrade podman-gvproxy-debuginfoUpgrade skopeo-testsUpgrade podman-remote-debuginfoUpgrade udicaUpgrade runc-debugsourceUpgrade crun-debugsourceUpgrade crunUpgrade slirp4netns-debuginfoUpgrade runc-debuginfoUpgrade criu-libs-debuginfoUpgrade criu-debugsourceUpgrade criu-develUpgrade toolbox-debuginfoNo solution existsUpgrade podman-plugins-debuginfoUpgrade container-selinuxUpgrade toolbox-debugsourceUpgrade conmon-debuginfoUpgrade python3-criuUpgrade podman-pluginsUpgrade cockpit-podmanUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-debugsourceUpgrade podman-debugsourceUpgrade podman-dockerUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-plugins | Sep 13, 2024 | May 14, 2024 |
| Rocky_linux | — | Upgrade podman-remote-debuginfoUpgrade podman-testsUpgrade runc-debuginfoUpgrade crunUpgrade netavarkUpgrade libslirpUpgrade podman-catatonit-debuginfoUpgrade slirp4netnsUpgrade fuse-overlayfsUpgrade toolboxUpgrade containernetworking-plugins-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade criuUpgrade podman-pluginsUpgrade crun-debuginfoUpgrade criu-develUpgrade skopeo-testsUpgrade slirp4netns-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade podmanUpgrade buildah-debugsourceUpgrade conmonUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade conmon-debugsourceUpgrade libslirp-develUpgrade buildah-testsUpgrade python3-criuUpgrade libslirp-debugsourceUpgrade crun-debugsourceUpgrade criu-debuginfoUpgrade runc-debugsourceUpgrade criu-libsUpgrade podman-remoteUpgrade podman-gvproxy-debuginfoUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsourceUpgrade containers-commonUpgrade conmon-debuginfoUpgrade aardvark-dnsUpgrade podman-debugsourceUpgrade podman-debuginfoUpgrade toolbox-testsUpgrade toolbox-debuginfoUpgrade containernetworking-pluginsUpgrade buildahUpgrade criu-libs-debuginfoUpgrade buildah-debuginfoUpgrade toolbox-debugsourceUpgrade podman-plugins-debuginfoUpgrade runcUpgrade libslirp-debuginfoUpgrade criu-debugsourceUpgrade critUpgrade buildah-tests-debuginfo | Aug 22, 2024 | May 14, 2024 |
| Suse | — | Upgrade containerized-data-importer-operatorUpgrade buildahUpgrade containerized-data-importer-manifestsUpgrade containerized-data-importer-clonerUpgrade containerized-data-importer-uploadproxyUpgrade apptainer-sle15_6Upgrade apptainerUpgrade docker-zsh-completionUpgrade squashfuseUpgrade containerized-data-importer-uploadserverUpgrade podman-dockerUpgrade skopeo-bash-completionUpgrade apptainer-sle15_5Upgrade warewulf4-manUpgrade warewulf4-overlay-slurmUpgrade containerized-data-importer-importerUpgrade libsquashfuse0Upgrade skopeo-zsh-completionUpgrade skopeoUpgrade warewulf4Upgrade dockerUpgrade containerized-data-importer-controllerUpgrade squashfuse-toolsUpgrade govulncheck-vulndbUpgrade docker-fish-completionUpgrade podman-cni-configUpgrade skopeo-fish-completionUpgrade warewulf4-overlayUpgrade podman-remoteUpgrade podmanUpgrade docker-rootless-extrasUpgrade apptainer-leapUpgrade docker-bash-completionUpgrade squashfuse-develUpgrade obs-service-cdi_containers_metaUpgrade podmanshUpgrade containerized-data-importer-api | May 30, 2024 | May 14, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub