A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-seccomp-bpf-hookUpgrade containernetworking-pluginsUpgrade runcUpgrade aardvark-dnsUpgrade skopeo-testsUpgrade python3-criuUpgrade podmanUpgrade critUpgrade libslirp-develUpgrade skopeoUpgrade podman-pluginsUpgrade criu-libsUpgrade containers-commonUpgrade podman-remoteUpgrade criu-develUpgrade netavarkUpgrade buildah-testsUpgrade buildahUpgrade conmonUpgrade podman-testsUpgrade toolboxUpgrade toolbox-testsUpgrade crunUpgrade udicaUpgrade container-selinuxUpgrade criuUpgrade libslirpUpgrade podman-gvproxyUpgrade cockpit-podmanUpgrade python3-podmanUpgrade podman-dockerUpgrade slirp4netnsUpgrade podman-catatonitUpgrade fuse-overlayfs | Oct 16, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | Upgrade golang-github-containers-commonNo solution exists | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade skopeoUpgrade python3-criuUpgrade crunUpgrade criu-libsUpgrade skopeo-testsUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade podman-pluginsUpgrade libslirp-develUpgrade criu-develUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade netavarkUpgrade buildah-testsUpgrade buildahUpgrade runcUpgrade podman-remoteUpgrade podman-gvproxyUpgrade python3-podmanUpgrade fuse-overlayfsUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade podman-testsUpgrade podman-dockerUpgrade libslirpUpgrade criuUpgrade podman-catatonitUpgrade aardvark-dnsUpgrade podmanUpgrade crit | Oct 16, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade rhcosUpgrade cri-o | Oct 17, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade buildahUpgrade toolbox-testsUpgrade libslirpUpgrade aardvark-dnsUpgrade python3-criuUpgrade podman-gvproxyUpgrade conmon-debugsourceUpgrade container-selinuxUpgrade fuse-overlayfsUpgrade toolbox-debuginfoUpgrade criu-debuginfoUpgrade podman-plugins-debuginfoUpgrade cockpit-podmanUpgrade buildah-debuginfoUpgrade criu-debugsourceUpgrade udicaUpgrade conmon-debuginfoUpgrade libslirp-debuginfoUpgrade criuUpgrade podman-gvproxy-debuginfoUpgrade slirp4netnsUpgrade buildah-testsUpgrade runc-debugsourceUpgrade podman-dockerUpgrade buildah-tests-debuginfoUpgrade crun-debuginfoUpgrade podman-testsUpgrade crunUpgrade toolboxUpgrade runcUpgrade python3-podmanUpgrade podman-debugsourceUpgrade podman-catatonitUpgrade podman-catatonit-debuginfoUpgrade podman-debuginfoUpgrade podman-pluginsUpgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade containers-commonUpgrade containernetworking-plugins-debuginfoUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debugsourceUpgrade conmonUpgrade criu-libsUpgrade libslirp-develUpgrade criu-develUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeo-testsUpgrade podmanUpgrade podman-remoteUpgrade slirp4netns-debugsourceUpgrade containernetworking-pluginsUpgrade critUpgrade fuse-overlayfs-debugsourceUpgrade runc-debuginfoUpgrade libslirp-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-remote-debuginfoUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-plugins-debugsourceUpgrade netavark | Oct 16, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade runc-debugsourceUpgrade podmanUpgrade buildahUpgrade oci-seccomp-bpf-hookUpgrade criuUpgrade toolbox-testsUpgrade crun-debugsourceUpgrade podman-catatonit-debuginfoUpgrade fuse-overlayfsUpgrade criu-debuginfoUpgrade podman-catatonitUpgrade conmonUpgrade criu-libsUpgrade aardvark-dnsUpgrade buildah-tests-debuginfoUpgrade libslirpUpgrade buildah-testsUpgrade conmon-debugsourceUpgrade netavarkUpgrade criu-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade containers-commonUpgrade fuse-overlayfs-debuginfoUpgrade toolboxUpgrade skopeoUpgrade buildah-debuginfoUpgrade podman-pluginsUpgrade crun-debuginfoUpgrade podman-remoteUpgrade podman-gvproxyUpgrade buildah-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-debuginfoUpgrade podman-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade slirp4netnsUpgrade criu-develUpgrade podman-remote-debuginfoUpgrade criu-libs-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade runcUpgrade python3-criuUpgrade crunUpgrade podman-testsUpgrade critUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade slirp4netns-debuginfoUpgrade podman-debuginfoUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade toolbox-debugsourceUpgrade podman-debugsourceUpgrade toolbox-debuginfoUpgrade libslirp-develUpgrade libslirp-debugsource | Nov 4, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade podmanshUpgrade govulncheck-vulndbUpgrade podman-remoteUpgrade podmanUpgrade buildahUpgrade podman-docker | Dec 31, 2024 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub