containers/image: digest type does not guarantee valid type

🗓️ 27 Jun 2024 13:06:17Reported by RedHatType

redhat🔗 access.redhat.com👁 11 Views

Flaw in containers image library lets attackers access registries as a victim, causing resource exhaustion.

Reporter	Title	Published	Views	Family All 320
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Go affect IBM Robotic Process Automation for Cloud Pak	4 Feb 202520:53	–	ibm
Tenable Nessus	Alibaba Cloud Linux 3 : 0164: container-tools:rhel8 (ALINUX3-SA-2024:0164)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : container-tools:rhel8 (ALSA-2024:5258)	14 Aug 202400:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: containerized-data-importer / cri-o / ig / libcontainers-common / skopeo (CVE-2024-3727)	10 Feb 202500:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: aardvark-dns Multiple Vulnerabilities (ciqsa-2026_0001)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (ciqsa-2026_0014)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: cockpit-podman Multiple Vulnerabilities (ciqsa-2026_0019)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: conmon / conmon-debuginfo / conmon-debugsource Multiple Vulnerabilities (ciqsa-2026_0021)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: containernetworking-plugins / containernetworking-plugins-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0022)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: containers-common Multiple Vulnerabilities (ciqsa-2026_0023)	1 Oct 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	aarch64	podman	4:4.9.4-5.1.rhaos4.16.el8	podman-4:4.9.4-5.1.rhaos4.16.el8.aarch64.rpm
Red Hat Enterprise Linux	8	ppc64le	podman	4:4.9.4-5.1.rhaos4.16.el8	podman-4:4.9.4-5.1.rhaos4.16.el8.ppc64le.rpm
Red Hat Enterprise Linux	8	s390x	podman	4:4.9.4-5.1.rhaos4.16.el8	podman-4:4.9.4-5.1.rhaos4.16.el8.s390x.rpm
Red Hat Enterprise Linux	8	x86_64	podman	4:4.9.4-5.1.rhaos4.16.el8	podman-4:4.9.4-5.1.rhaos4.16.el8.x86_64.rpm
Red Hat Enterprise Linux	9	aarch64	podman	4:4.9.4-5.1.rhaos4.16.el9	podman-4:4.9.4-5.1.rhaos4.16.el9.aarch64.rpm
Red Hat Enterprise Linux	9	ppc64le	podman	4:4.9.4-5.1.rhaos4.16.el9	podman-4:4.9.4-5.1.rhaos4.16.el9.ppc64le.rpm
Red Hat Enterprise Linux	9	s390x	podman	4:4.9.4-5.1.rhaos4.16.el9	podman-4:4.9.4-5.1.rhaos4.16.el9.s390x.rpm
Red Hat Enterprise Linux	9	x86_64	podman	4:4.9.4-5.1.rhaos4.16.el9	podman-4:4.9.4-5.1.rhaos4.16.el9.x86_64.rpm
Red Hat Enterprise Linux	8	aarch64	podman-catatonit	4:4.9.4-5.1.rhaos4.16.el8	podman-catatonit-4:4.9.4-5.1.rhaos4.16.el8.aarch64.rpm
Red Hat Enterprise Linux	8	ppc64le	podman-catatonit	4:4.9.4-5.1.rhaos4.16.el8	podman-catatonit-4:4.9.4-5.1.rhaos4.16.el8.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2024-3727
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-3727
cve	www.cve.org/CVERecord

04 Oct 2026 21:59Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.18.3

EPSS0.01279

SSVC

containers image library flaw registry access victim impersonation resource exhaustion path traversal