A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-testsUpgrade crunUpgrade toolboxUpgrade criuUpgrade container-selinuxUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade toolbox-testsUpgrade conmonUpgrade cockpit-podmanUpgrade udicaUpgrade podman-dockerUpgrade libslirpUpgrade netavarkUpgrade buildah-testsUpgrade python3-podmanUpgrade buildahUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade runcUpgrade containers-commonUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade critUpgrade podmanUpgrade podman-pluginsUpgrade skopeoUpgrade libslirp-develUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade python3-criuUpgrade criu-develUpgrade skopeo-testsUpgrade aardvark-dns | Oct 16, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade podmanUpgrade buildah | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | Upgrade golang-github-containers-common | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade podman-testsUpgrade slirp4netnsUpgrade critUpgrade netavarkUpgrade criuUpgrade libslirpUpgrade podman-dockerUpgrade fuse-overlayfsUpgrade runcUpgrade podman-catatonitUpgrade aardvark-dnsUpgrade podmanUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade podman-remoteUpgrade python3-podmanUpgrade buildahUpgrade buildah-testsUpgrade containers-commonUpgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade crunUpgrade criu-libsUpgrade conmonUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade libslirp-develUpgrade skopeoUpgrade python3-criuUpgrade skopeo-tests | Oct 16, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade rhcosUpgrade cri-o | Oct 17, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade cockpit-podmanUpgrade udicaUpgrade criu-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-gvproxyUpgrade buildahUpgrade runc-debugsourceUpgrade podman-testsUpgrade buildah-tests-debuginfoUpgrade buildah-testsUpgrade slirp4netnsUpgrade buildah-debuginfoUpgrade conmon-debuginfoUpgrade crun-debuginfoUpgrade libslirp-debuginfoUpgrade aardvark-dnsUpgrade libslirpUpgrade python3-criuUpgrade toolbox-testsUpgrade criuUpgrade podman-gvproxy-debuginfoUpgrade podman-dockerUpgrade fuse-overlayfsUpgrade conmon-debugsourceUpgrade container-selinuxUpgrade criu-debuginfoUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-plugins-debugsourceUpgrade python3-podmanUpgrade containernetworking-plugins-debuginfoUpgrade conmonUpgrade buildah-debugsourceUpgrade crun-debugsourceUpgrade skopeoUpgrade podman-pluginsUpgrade podman-debuginfoUpgrade podman-debugsourceUpgrade podman-catatonitUpgrade netavarkUpgrade critUpgrade runc-debuginfoUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-remoteUpgrade podmanUpgrade skopeo-testsUpgrade podman-remote-debuginfoUpgrade libslirp-debugsourceUpgrade runcUpgrade libslirp-develUpgrade crunUpgrade fuse-overlayfs-debugsourceUpgrade criu-libsUpgrade toolbox-debugsourceUpgrade slirp4netns-debuginfoUpgrade criu-develUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonit-debuginfoUpgrade toolbox | Oct 16, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade buildah-debuginfoUpgrade libslirpUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade criu-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade criuUpgrade buildah-tests-debuginfoUpgrade conmon-debugsourceUpgrade containers-commonUpgrade netavarkUpgrade buildah-testsUpgrade toolbox-testsUpgrade aardvark-dnsUpgrade podmanUpgrade fuse-overlayfsUpgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade toolboxUpgrade crun-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade criu-libsUpgrade podman-catatonitUpgrade runc-debugsourceUpgrade podman-catatonit-debuginfoUpgrade conmonUpgrade criu-debuginfoUpgrade toolbox-debuginfoUpgrade libslirp-debugsourceUpgrade buildah-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-testsUpgrade runcUpgrade criu-libs-debuginfoUpgrade criu-develUpgrade podman-debugsourceUpgrade podman-remote-debuginfoUpgrade slirp4netnsUpgrade podman-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade slirp4netns-debuginfoUpgrade podman-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade critUpgrade conmon-debuginfoUpgrade podman-pluginsUpgrade podman-gvproxyUpgrade toolbox-debugsourceUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-develUpgrade libslirp-debuginfoUpgrade crun-debuginfoUpgrade podman-remoteUpgrade python3-criuUpgrade crunUpgrade containernetworking-plugins-debuginfo | Nov 4, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade podman-dockerUpgrade podmanUpgrade buildahUpgrade govulncheck-vulndbUpgrade podmanshUpgrade podman-remote | Dec 31, 2024 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub