CVE-2024-3727CWE-354

CVE-2024-3727

High · published May 14, 2024

CVSS v3.1
8.3
EPSS
1%
Percentile
69.8
In the wild
Unconfirmed
What it is

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01279 · 69.8th percentile
Weakness
CWE-354 · Improper Validation of Integrity Check Value
Published
2024-05-14T19:42Z
References (41)
https://access.redhat.com/errata/RHSA-2024:0045 · [email protected]https://access.redhat.com/errata/RHSA-2024:3718 · [email protected]https://access.redhat.com/errata/RHSA-2024:4159 · [email protected]https://access.redhat.com/errata/RHSA-2024:4613 · [email protected]https://access.redhat.com/errata/RHSA-2024:4850 · [email protected]https://access.redhat.com/errata/RHSA-2024:4960 · [email protected]https://access.redhat.com/errata/RHSA-2024:5258 · [email protected]https://access.redhat.com/errata/RHSA-2024:5951 · [email protected]https://access.redhat.com/errata/RHSA-2024:6054 · [email protected]https://access.redhat.com/errata/RHSA-2024:6122 · [email protected]https://access.redhat.com/errata/RHSA-2024:6708 · [email protected]https://access.redhat.com/errata/RHSA-2024:6818 · [email protected]https://access.redhat.com/errata/RHSA-2024:6824 · [email protected]https://access.redhat.com/errata/RHSA-2024:7164 · [email protected]https://access.redhat.com/errata/RHSA-2024:7174 · [email protected]https://access.redhat.com/errata/RHSA-2024:7182 · [email protected]https://access.redhat.com/errata/RHSA-2024:7187 · [email protected]https://access.redhat.com/errata/RHSA-2024:7922 · [email protected]https://access.redhat.com/errata/RHSA-2024:7941 · [email protected]https://access.redhat.com/errata/RHSA-2024:8260 · [email protected]https://access.redhat.com/errata/RHSA-2024:8425 · [email protected]https://access.redhat.com/errata/RHSA-2024:9097 · [email protected]https://access.redhat.com/errata/RHSA-2024:9098 · [email protected]https://access.redhat.com/errata/RHSA-2024:9102 · [email protected]https://access.redhat.com/errata/RHSA-2024:9960 · [email protected]https://access.redhat.com/security/cve/CVE-2024-3727 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2274767 · [email protected]https://access.redhat.com/errata/RHSA-2024:0045 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:4159 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:4613 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/security/cve/CVE-2024-3727 · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=2274767 · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/4HEYS34N55G7NOQZKNEXZKQVNDGEICCD/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/6B37TXOKTKDBE2V26X2NSP7JKNMZOFVP/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/CYT3D2P3OJKISNFKOOHGY6HCUCQZYAVR/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/DLND3YDQQRWVRIUPL2G5UKXP5L3VSBBT/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/DTOMYERG5ND4QFDHC4ZSGCED3T3ESRSC/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/FBZQ2ZRMFEUQ35235B2HWPSXGDCBZHFV/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/QFXMF3VVKIZN7ZMB7PKZCSWV6MOMTGMQ/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/SFVSMR7TNLO2KPWJSW4CF64C2QMQXCIN/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 09 MAY 14:57Z
    Containers/image: digest type does not guarantee valid type
    cvelistv5