GoogleOSV:GHSA-6WVF-F2VW-3425github.com/containers/image allows unexpected authenticated registry accesses
8.3 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
7.9 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
8.8%
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
References
access.redhat.com/security/cve/CVE-2024-3727
bugzilla.redhat.com/show_bug.cgi?id=2274767
github.com/containers/image
github.com/containers/image/commit/132678b47bae29c710589012668cb85859d88385
github.com/containers/image/commit/e8948046055060605bd68289d406ce149590c33a
github.com/containers/image/releases/tag/v5.29.3
github.com/containers/image/releases/tag/v5.30.1
nvd.nist.gov/vuln/detail/CVE-2024-3727
Related
8.3 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
7.9 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
8.8%