CVE-2024-3727
Containers/image: digest type does not guarantee valid type
Severity Score
8.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
Se encontró una falla en la librería github.com/containers/image. Esta falla permite a los atacantes activar accesos inesperados al registro autenticado en nombre de un usuario víctima, lo que provoca agotamiento de recursos, path traversal local y otros ataques.
This update for warewulf4 fixes the following issues. Fixed wwctl configure --all doesn't configure ssh update to 4.5.2 with following changes. Reorder dnsmasq config to put iPXE last Update go-digest dependency to fix digest values not always validated updated to version 4.5.1 with following changes wwctl [profile|node] list -a handles now slices correctly. Fixed a locking issue with concurrent read/writes for node status Remove API package as use of this wasn't documented use tftp.socket for activation.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-04-12 CVE Reserved
- 2024-05-09 CVE Published
- 2026-04-29 CVE Updated
- 2026-05-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-354: Improper Validation of Integrity Check Value
CAPEC
References (36)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Oracle Search vendor "Oracle" | Exadata Dbserver Search vendor "Oracle" for product "Exadata Dbserver" | * | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Linux Search vendor "Oracle" for product "Linux" | * | - |
Affected
| ||||||
| Red Hat Search vendor "Red Hat" | Enterprise Linux Search vendor "Red Hat" for product "Enterprise Linux" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Acm Search vendor "Redhat" for product "Acm" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Advanced Cluster Management For Kubernetes Search vendor "Redhat" for product "Advanced Cluster Management For Kubernetes" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Advanced Cluster Security Search vendor "Redhat" for product "Advanced Cluster Security" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Ansible Automation Platform Search vendor "Redhat" for product "Ansible Automation Platform" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Assisted Installer Search vendor "Redhat" for product "Assisted Installer" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Container Native Virtualization Search vendor "Redhat" for product "Container Native Virtualization" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Migration Toolkit Search vendor "Redhat" for product "Migration Toolkit" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Multicluster Engine Search vendor "Redhat" for product "Multicluster Engine" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Ocp Tools Search vendor "Redhat" for product "Ocp Tools" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Openshift Search vendor "Redhat" for product "Openshift" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Openshift Api Data Protection Search vendor "Redhat" for product "Openshift Api Data Protection" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Openshift Devspaces Search vendor "Redhat" for product "Openshift Devspaces" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Openshift Ironic Search vendor "Redhat" for product "Openshift Ironic" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Openshift Sandboxed Containers Search vendor "Redhat" for product "Openshift Sandboxed Containers" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Openstack Search vendor "Redhat" for product "Openstack" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Quay Search vendor "Redhat" for product "Quay" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Rhmt Search vendor "Redhat" for product "Rhmt" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Serverless Search vendor "Redhat" for product "Serverless" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Source To Image Search vendor "Redhat" for product "Source To Image" | * | - |
Affected
| ||||||
| Alma Search vendor "Alma" | Linux Search vendor "Alma" for product "Linux" | * | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | * | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | * | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Linux Search vendor "Oracle" for product "Linux" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Openshift Search vendor "Redhat" for product "Openshift" | * | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Rhel Eus Search vendor "Redhat" for product "Rhel Eus" | * | - |
Affected
| ||||||
| Rocky Search vendor "Rocky" | Linux Search vendor "Rocky" for product "Linux" | * | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Packagehub Search vendor "Suse" for product "Packagehub" | * | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Sle-module-basesystem Search vendor "Suse" for product "Sle-module-basesystem" | * | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Sle-module-containers Search vendor "Suse" for product "Sle-module-containers" | * | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Sle-module-hpc Search vendor "Suse" for product "Sle-module-hpc" | * | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Sle Hpc-espos Search vendor "Suse" for product "Sle Hpc-espos" | * | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Sle Hpc-ltss Search vendor "Suse" for product "Sle Hpc-ltss" | * | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Sle Hpc Search vendor "Suse" for product "Sle Hpc" | * | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Sled Search vendor "Suse" for product "Sled" | * | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Sles-ltss Search vendor "Suse" for product "Sles-ltss" | * | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Sles Search vendor "Suse" for product "Sles" | * | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Sles Sap Search vendor "Suse" for product "Sles Sap" | * | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Suse-manager-proxy Search vendor "Suse" for product "Suse-manager-proxy" | * | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Suse-manager-server Search vendor "Suse" for product "Suse-manager-server" | * | - |
Affected
| ||||||