Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-6WVF-F2VW-3425
HistoryMay 14, 2024 - 6:30 p.m.

github.com/containers/image allows unexpected authenticated registry accesses

2024-05-1418:30:52
CWE-354
GitHub Advisory Database
github.com
4
github
containers/image
authenticated
registry
flaw
attackers
resource exhaustion
local path traversal
security

8.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

6.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.1%

JSON

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

Affected configurations

Vulners
Node
containers-image_projectcontainers-imageRange<5.29.3
OR
containers-image_projectcontainers-imageRange<5.30.1
OR
containers-image_projectcontainers-imageRange<5.30.1

References

Related

openvas 14
nessus 16
ubuntucve 1
fedora 9
vulnrichment 1
redhatcve 1
cve 1
wolfi 1
alpinelinux 1
osv 2
debiancve 1
cvelist 1
veracode 1
nvd 1
cbl_mariner 1
openvas
openvas
Fedora: Security Advisory for buildah (FEDORA-2024-c56e6ff1b5)
2024-05-27 00:00:00
Fedora: Security Advisory for apptainer (FEDORA-2024-f4a65623e7)
2024-06-07 00:00:00
Fedora: Security Advisory for prometheus-podman-exporter (FEDORA-2024-2f8a62d6d6)
2024-06-11 00:00:00
nessus
nessus
SUSE SLES15 / openSUSE 15 Security Update : cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer (SUSE-SU-2024:1989-1)
2024-06-12 00:00:00
Fedora 40 : podman (2024-20393c122f)
2024-05-17 00:00:00
Fedora 40 : prometheus-podman-exporter (2024-2f8a62d6d6)
2024-06-11 00:00:00
ubuntucve
ubuntucve
CVE-2024-3727
2024-05-14 00:00:00
fedora
fedora
[SECURITY] Fedora 40 Update: podman-5.0.3-1.fc40
2024-05-17 01:09:09
[SECURITY] Fedora 39 Update: prometheus-podman-exporter-1.12.0-1.fc39
2024-06-11 01:59:07
[SECURITY] Fedora 39 Update: buildah-1.35.4-1.fc39
2024-05-19 02:46:24
vulnrichment
vulnrichment
CVE-2024-3727 Containers/image: digest type does not guarantee valid type
2024-05-09 14:57:21
redhatcve
redhatcve
CVE-2024-3727
2024-05-09 14:55:55
cve
cve
CVE-2024-3727
2024-05-14 15:42:07
wolfi
wolfi
CVE-2024-3727 vulnerabilities
2024-06-26 03:08:30
alpinelinux
alpinelinux
CVE-2024-3727
2024-05-14 15:42:07
osv
osv
github.com/containers/image allows unexpected authenticated registry accesses
2024-05-14 18:30:52
Unexpected authenticated registry accesses in github.com/containers/image/v5
2024-05-20 19:45:51
debiancve
debiancve
CVE-2024-3727
2024-05-14 15:42:07
cvelist
cvelist
CVE-2024-3727 Containers/image: digest type does not guarantee valid type
2024-05-09 14:57:21
veracode
veracode
Improper Digest Validation
2024-05-15 08:41:06
nvd
nvd
CVE-2024-3727
2024-05-14 15:42:07
cbl_mariner
cbl_mariner
CVE-2024-3727 affecting package ig for versions less than 0.29.0-1
2024-06-21 09:32:44

8.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

6.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.1%

JSON
Related for GHSA-6WVF-F2VW-3425
openvas14nessus16ubuntucve1fedora9vulnrichment1redhatcve1cve1wolfi1alpinelinux1osv2debiancve1cvelist1veracode1nvd1cbl_mariner1