A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirp-develUpgrade criu-libsUpgrade runcUpgrade oci-seccomp-bpf-hookUpgrade aardvark-dnsUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade skopeoUpgrade criu-develUpgrade critUpgrade podman-pluginsUpgrade podman-remoteUpgrade skopeo-testsUpgrade podmanUpgrade python3-criuUpgrade podman-dockerUpgrade crunUpgrade cockpit-podmanUpgrade criuUpgrade fuse-overlayfsUpgrade toolboxUpgrade podman-catatonitUpgrade podman-gvproxyUpgrade conmonUpgrade toolbox-testsUpgrade libslirpUpgrade container-selinuxUpgrade python3-podmanUpgrade netavarkUpgrade buildahUpgrade buildah-testsUpgrade podman-testsUpgrade udicaUpgrade slirp4netns | Oct 16, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | No solution existsUpgrade golang-github-containers-common | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade cockpit-podmanUpgrade podman-gvproxyUpgrade buildah-testsUpgrade podman-remoteUpgrade libslirpUpgrade python3-podmanUpgrade runcUpgrade buildahUpgrade slirp4netnsUpgrade criuUpgrade podman-testsUpgrade podman-dockerUpgrade aardvark-dnsUpgrade podman-catatonitUpgrade netavarkUpgrade fuse-overlayfsUpgrade podmanUpgrade critUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade container-selinuxUpgrade skopeo-testsUpgrade libslirp-develUpgrade criu-develUpgrade python3-criuUpgrade crunUpgrade skopeoUpgrade criu-libsUpgrade conmonUpgrade podman-plugins | Oct 16, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade cri-oUpgrade rhcos | Oct 17, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade criu-develUpgrade podman-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade criu-libsUpgrade critUpgrade crunUpgrade containernetworking-pluginsUpgrade slirp4netns-debuginfoUpgrade toolbox-debugsourceUpgrade libslirp-develUpgrade skopeo-testsUpgrade criu-libs-debuginfoUpgrade podman-remoteUpgrade runc-debuginfoUpgrade slirp4netns-debugsourceUpgrade containers-commonUpgrade crun-debugsourceUpgrade podman-catatonitUpgrade podmanUpgrade podman-catatonit-debuginfoUpgrade conmonUpgrade python3-podmanUpgrade runcUpgrade podman-debuginfoUpgrade buildah-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade netavarkUpgrade podman-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade skopeoUpgrade libslirp-debugsourceUpgrade podman-remote-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade toolboxUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolbox-testsUpgrade runc-debugsourceUpgrade buildahUpgrade podman-gvproxyUpgrade podman-plugins-debuginfoUpgrade criu-debugsourceUpgrade python3-criuUpgrade aardvark-dnsUpgrade libslirpUpgrade buildah-testsUpgrade podman-testsUpgrade criuUpgrade udicaUpgrade libslirp-debuginfoUpgrade conmon-debuginfoUpgrade crun-debuginfoUpgrade buildah-debuginfoUpgrade toolbox-debuginfoUpgrade container-selinuxUpgrade fuse-overlayfsUpgrade cockpit-podmanUpgrade conmon-debugsourceUpgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade slirp4netnsUpgrade podman-gvproxy-debuginfoUpgrade podman-docker | Oct 16, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade toolboxUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonitUpgrade buildahUpgrade conmon-debugsourceUpgrade netavarkUpgrade conmonUpgrade crun-debugsourceUpgrade fuse-overlayfsUpgrade criu-debuginfoUpgrade buildah-testsUpgrade libslirpUpgrade toolbox-testsUpgrade criu-libsUpgrade skopeoUpgrade podman-catatonit-debuginfoUpgrade buildah-debuginfoUpgrade criu-debugsourceUpgrade buildah-tests-debuginfoUpgrade aardvark-dnsUpgrade criuUpgrade runc-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-plugins-debugsourceUpgrade containers-commonUpgrade podmanUpgrade toolbox-debuginfoUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libs-debuginfoUpgrade criu-develUpgrade slirp4netnsUpgrade podman-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade podman-gvproxy-debuginfoUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade toolbox-debugsourceUpgrade podman-debugsourceUpgrade libslirp-develUpgrade crun-debuginfoUpgrade podman-remoteUpgrade libslirp-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade slirp4netns-debugsourceUpgrade runcUpgrade python3-criuUpgrade podman-testsUpgrade crunUpgrade podman-gvproxyUpgrade critUpgrade conmon-debuginfoUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-pluginsUpgrade podman-debuginfoUpgrade podman-remote-debuginfo | Nov 4, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade podmanshUpgrade govulncheck-vulndbUpgrade podman-remoteUpgrade buildahUpgrade podmanUpgrade podman-docker | Dec 31, 2024 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub