Vulnerability · Published May 9, 2024 · Assigned by redhat

CVE-2024-3727Containers/image: digest type does not guarantee valid type

High 8.3

In plain English

A high-severity security flaw in image. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)1.3%top 29.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	aardvark-dns	2:1.10.0-1.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	aardvark-dns	2:1.10.0-1.module_el8.10.0+3792+03eaed9c	ALSA-2024:5258
AlmaLinux:8	aardvark-dns	2:1.10.0-1.module_el8.10.0+3858+6ad51f9f	ALSA-2024:5258
AlmaLinux:8	buildah	2:1.33.8-4.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:9	buildah	2:1.37.2-1.el9	ALSA-2024:9097
AlmaLinux:8	buildah-tests	2:1.33.8-4.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:9	buildah-tests	2:1.37.2-1.el9	ALSA-2024:9097
AlmaLinux:8	cockpit-podman	84.1-1.module_el8.10.0+3858+6ad51f9f	ALSA-2024:5258
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+3845+87b84552	ALSA-2024:5258
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+3858+6ad51f9f	ALSA-2024:5258
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	container-selinux	2:2.229.0-2.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	containernetworking-plugins	1:1.4.0-5.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	containers-common	2:1-82.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	crit	3.18-5.module_el8.10.0+3845+87b84552	ALSA-2024:5258
AlmaLinux:8	crit	3.18-5.module_el8.10.0+3858+6ad51f9f	ALSA-2024:5258
AlmaLinux:8	criu	3.18-5.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	criu	3.18-5.module_el8.10.0+3845+87b84552	ALSA-2024:5258
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+3858+6ad51f9f	ALSA-2024:5258
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+3845+87b84552	ALSA-2024:5258
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	crun	1.14.3-2.module_el8.10.0+3858+6ad51f9f	ALSA-2024:5258
AlmaLinux:8	crun	1.14.3-2.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+3859+6ae70a0e	ALSA-2024:5258
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+3792+03eaed9c	ALSA-2024:5258
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+3858+6ad51f9f	ALSA-2024:5258
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+3858+6ad51f9f	ALSA-2024:5258
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+3858+6ad51f9f	ALSA-2024:5258
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+3792+03eaed9c	ALSA-2024:5258
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	podman	4:4.9.4-12.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	podman-catatonit	4:4.9.4-12.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	podman-docker	4:4.9.4-12.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	podman-gvproxy	4:4.9.4-12.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	podman-plugins	4:4.9.4-12.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	podman-remote	4:4.9.4-12.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	podman-tests	4:4.9.4-12.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	python3-podman	4.9.0-2.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	runc	1:1.1.12-4.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	skopeo	2:1.14.5-3.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:9	skopeo	2:1.16.1-1.el9	ALSA-2024:9098
AlmaLinux:8	skopeo-tests	2:1.14.5-3.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:9	skopeo-tests	2:1.16.1-1.el9	ALSA-2024:9098
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+3858+6ad51f9f	ALSA-2024:5258
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+3845+87b84552	ALSA-2024:5258
AlmaLinux:8	toolbox	0.0.99.5-2.module_el8.10.0+3858+6ad51f9f	ALSA-2024:5258
AlmaLinux:8	toolbox	0.0.99.5-2.module_el8.10.0+3845+87b84552	ALSA-2024:5258
AlmaLinux:8	toolbox	0.0.99.5-2.module_el8.10.0+3876+e55593a8	ALSA-2024:5258
AlmaLinux:8	toolbox-tests	0.0.99.5-2.module_el8.10.0+3845+87b84552	ALSA-2024:5258
AlmaLinux:8	toolbox-tests	0.0.99.5-2.module_el8.10.0+3858+6ad51f9f	ALSA-2024:5258
AlmaLinux:8	udica	0.2.6-21.module_el8.10.0+3858+6ad51f9f	ALSA-2024:5258
Alpine:v3.20	buildah	1.35.4-r0	ALPINE-CVE-2024-3727
Alpine:v3.21	buildah	1.35.4-r0	ALPINE-CVE-2024-3727
Alpine:v3.22	buildah	1.35.4-r0	ALPINE-CVE-2024-3727
Alpine:v3.23	buildah	1.35.4-r0	ALPINE-CVE-2024-3727
Alpine:v3.24	buildah	1.35.4-r0	ALPINE-CVE-2024-3727
Alpine:v3.20	podman	5.0.3-r0	ALPINE-CVE-2024-3727
Alpine:v3.21	podman	5.0.3-r0	ALPINE-CVE-2024-3727
Alpine:v3.22	podman	5.0.3-r0	ALPINE-CVE-2024-3727
Alpine:v3.23	podman	5.0.3-r0	ALPINE-CVE-2024-3727
Alpine:v3.24	podman	5.0.3-r0	ALPINE-CVE-2024-3727
Alpine:v3.20	skopeo	1.15.1-r0	ALPINE-CVE-2024-3727
Alpine:v3.21	skopeo	1.15.1-r0	ALPINE-CVE-2024-3727
Alpine:v3.22	skopeo	1.15.1-r0	ALPINE-CVE-2024-3727
Alpine:v3.23	skopeo	1.15.1-r0	ALPINE-CVE-2024-3727
Alpine:v3.24	skopeo	1.15.1-r0	ALPINE-CVE-2024-3727
Debian:12	golang-github-containers-image	no fix listed	DEBIAN-CVE-2024-3727
Debian:13	golang-github-containers-image	5.29.3-1	DEBIAN-CVE-2024-3727
Debian:14	golang-github-containers-image	5.29.3-1	DEBIAN-CVE-2024-3727
Go	github.com/containers/image	5.30.1	GHSA-6wvf-f2vw-3425
Go	github.com/containers/image/v5	5.29.3, 5.30.1	GO-2024-2842
Go	github.com/containers/image/v5	5.29.3	GHSA-6wvf-f2vw-3425
Go	github.com/containers/image/v5	5.30.1	GHSA-6wvf-f2vw-3425
Rocky Linux:8	aardvark-dns	2:1.10.0-1.module+el8.10.0+1815+5fe7415e	RLSA-2024:5258
Rocky Linux:8	buildah	2:1.33.8-4.module+el8.10.0+1843+6892ab28	RLSA-2024:5258
Rocky Linux:8	cockpit-podman	0:84.1-1.module+el8.10.0+1815+5fe7415e	RLSA-2024:5258
Rocky Linux:8	conmon	3:2.1.10-1.module+el8.10.0+1815+5fe7415e	RLSA-2024:5258
Rocky Linux:8	container-selinux	2:2.229.0-2.module+el8.10.0+1815+5fe7415e	RLSA-2024:5258
Rocky Linux:8	containernetworking-plugins	1:1.4.0-5.module+el8.10.0+1843+6892ab28	RLSA-2024:5258
Rocky Linux:8	containers-common	2:1-82.module+el8.10.0+1843+6892ab28	RLSA-2024:5258
Rocky Linux:8	criu	0:3.18-5.module+el8.10.0+1815+5fe7415e	RLSA-2024:5258
Rocky Linux:8	crun	0:1.14.3-2.module+el8.10.0+1815+5fe7415e	RLSA-2024:5258
Rocky Linux:8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1815+5fe7415e	RLSA-2024:5258
Rocky Linux:8	libslirp	0:4.4.0-2.module+el8.10.0+1815+5fe7415e	RLSA-2024:5258
Rocky Linux:8	netavark	2:1.10.3-1.module+el8.10.0+1815+5fe7415e	RLSA-2024:5258
Rocky Linux:8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1815+5fe7415e	RLSA-2024:5258
Rocky Linux:8	podman	4:4.9.4-12.module+el8.10.0+1843+6892ab28	RLSA-2024:5258
Rocky Linux:9	podman	4:5.2.2-13.el9_5	RLSA-2024:9102
Rocky Linux:8	python-podman	0:4.9.0-2.module+el8.10.0+1843+6892ab28	RLSA-2024:5258
Rocky Linux:8	runc	1:1.1.12-4.module+el8.10.0+1843+6892ab28	RLSA-2024:5258
Rocky Linux:8	skopeo	2:1.14.5-3.module+el8.10.0+1843+6892ab28	RLSA-2024:5258
Rocky Linux:8	slirp4netns	0:1.2.3-1.module+el8.10.0+1815+5fe7415e	RLSA-2024:5258
Rocky Linux:8	toolbox	0:0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2	RLSA-2024:5258
Rocky Linux:8	udica	0:0.2.6-21.module+el8.10.0+1815+5fe7415e	RLSA-2024:5258
Ubuntu:22.04:LTS	golang-github-opencontainers-go-digest	no fix listed	UBUNTU-CVE-2024-3727
Ubuntu:24.04:LTS	golang-github-opencontainers-go-digest	no fix listed	UBUNTU-CVE-2024-3727
Ubuntu:25.10	golang-github-opencontainers-go-digest	no fix listed	UBUNTU-CVE-2024-3727
Ubuntu:26.04:LTS	golang-github-opencontainers-go-digest	no fix listed	UBUNTU-CVE-2024-3727
Ubuntu:26.10	golang-github-opencontainers-go-digest	no fix listed	UBUNTU-CVE-2024-3727

Affected products (as reported)

Vendor	Product	Versions
	image	0 – before 5.29.35.30.0 – before 5.30.1
Red Hat	OADP-1.3-RHEL-9	see references
Red Hat	Red Hat Advanced Cluster Security 4.4	see references
Red Hat	Red Hat Advanced Cluster Security 4.4	see references
Red Hat	Red Hat Advanced Cluster Security 4.4	see references
Red Hat	Red Hat Advanced Cluster Security 4.4	see references
Red Hat	Red Hat Advanced Cluster Security 4.4	see references
Red Hat	Red Hat Advanced Cluster Security 4.4	see references
Red Hat	Red Hat Advanced Cluster Security 4.4	see references
Red Hat	Red Hat Advanced Cluster Security 4.4	see references
Red Hat	Red Hat Advanced Cluster Security 4.4	see references
Red Hat	Red Hat Advanced Cluster Security 4.4	see references
Red Hat	Red Hat Advanced Cluster Security 4.4	see references
Red Hat	Red Hat Advanced Cluster Security 4.4	see references
Red Hat	Red Hat Advanced Cluster Security 4.4	see references
Red Hat	Red Hat Advanced Cluster Security 4.5	see references
Red Hat	Red Hat Advanced Cluster Security 4.5	see references
Red Hat	Red Hat Advanced Cluster Security 4.5	see references
Red Hat	Red Hat Advanced Cluster Security 4.5	see references
Red Hat	Red Hat Advanced Cluster Security 4.5	see references
Red Hat	Red Hat Advanced Cluster Security 4.5	see references
Red Hat	Red Hat Advanced Cluster Security 4.5	see references
Red Hat	Red Hat Advanced Cluster Security 4.5	see references
Red Hat	Red Hat Advanced Cluster Security 4.5	see references
Red Hat	Red Hat Advanced Cluster Security 4.5	see references
Red Hat	Red Hat Advanced Cluster Security 4.5	see references
Red Hat	Red Hat Advanced Cluster Security 4.5	see references
Red Hat	Red Hat Advanced Cluster Security 4.5	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 9	see references

Weakness: CWE-354 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References

RHSA-2024:0045 vendor-advisory, x_refsource_REDHAT
RHSA-2024:3718 vendor-advisory, x_refsource_REDHAT
RHSA-2024:4159 vendor-advisory, x_refsource_REDHAT
RHSA-2024:4613 vendor-advisory, x_refsource_REDHAT
RHSA-2024:4850 vendor-advisory, x_refsource_REDHAT
RHSA-2024:4960 vendor-advisory, x_refsource_REDHAT
RHSA-2024:5258 vendor-advisory, x_refsource_REDHAT
RHSA-2024:5951 vendor-advisory, x_refsource_REDHAT
RHSA-2024:6054 vendor-advisory, x_refsource_REDHAT
RHSA-2024:6122 vendor-advisory, x_refsource_REDHAT
RHSA-2024:6708 vendor-advisory, x_refsource_REDHAT
RHSA-2024:6818 vendor-advisory, x_refsource_REDHAT
RHSA-2024:6824 vendor-advisory, x_refsource_REDHAT
RHSA-2024:7164 vendor-advisory, x_refsource_REDHAT
RHSA-2024:7174 vendor-advisory, x_refsource_REDHAT
RHSA-2024:7182 vendor-advisory, x_refsource_REDHAT
RHSA-2024:7187 vendor-advisory, x_refsource_REDHAT
RHSA-2024:7922 vendor-advisory, x_refsource_REDHAT
RHSA-2024:7941 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8260 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8425 vendor-advisory, x_refsource_REDHAT
RHSA-2024:9097 vendor-advisory, x_refsource_REDHAT
RHSA-2024:9098 vendor-advisory, x_refsource_REDHAT
RHSA-2024:9102 vendor-advisory, x_refsource_REDHAT
RHSA-2024:9960 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-3727 vdb-entry, x_refsource_REDHAT
RHBZ#2274767 issue-tracking, x_refsource_REDHAT
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4HEYS34N55G7NOQZKNEXZKQVNDGEICCD/ x_transferred
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6B37TXOKTKDBE2V26X2NSP7JKNMZOFVP/ x_transferred
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYT3D2P3OJKISNFKOOHGY6HCUCQZYAVR/ x_transferred
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLND3YDQQRWVRIUPL2G5UKXP5L3VSBBT/ x_transferred
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DTOMYERG5ND4QFDHC4ZSGCED3T3ESRSC/ x_transferred
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FBZQ2ZRMFEUQ35235B2HWPSXGDCBZHFV/ x_transferred
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/ x_transferred
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QFXMF3VVKIZN7ZMB7PKZCSWV6MOMTGMQ/ x_transferred
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFVSMR7TNLO2KPWJSW4CF64C2QMQXCIN/ x_transferred