containers/image: digest type does not guarantee valid type

🗓️ 03 Jul 2024 11:45:54Reported by RedHatType

redhat🔗 access.redhat.com👁 11 Views

Digest type in containers image may be invalid, enabling authenticated registry access and path traversal.

Reporter	Title	Published	Views	Family All 321
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Go affect IBM Robotic Process Automation for Cloud Pak	4 Feb 202520:53	–	ibm
Tenable Nessus	Alibaba Cloud Linux 3 : 0164: container-tools:rhel8 (ALINUX3-SA-2024:0164)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : container-tools:rhel8 (ALSA-2024:5258)	14 Aug 202400:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: containerized-data-importer / cri-o / ig / libcontainers-common / skopeo (CVE-2024-3727)	10 Feb 202500:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: aardvark-dns Multiple Vulnerabilities (ciqsa-2026_0001)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (ciqsa-2026_0014)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: cockpit-podman Multiple Vulnerabilities (ciqsa-2026_0019)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: conmon / conmon-debuginfo / conmon-debugsource Multiple Vulnerabilities (ciqsa-2026_0021)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: containernetworking-plugins / containernetworking-plugins-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0022)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: containers-common Multiple Vulnerabilities (ciqsa-2026_0023)	1 Oct 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	aarch64	cri-o	1.29.5-7.rhaos4.16.git7db4ada.el8	cri-o-1.29.5-7.rhaos4.16.git7db4ada.el8.aarch64.rpm
Red Hat Enterprise Linux	8	ppc64le	cri-o	1.29.5-7.rhaos4.16.git7db4ada.el8	cri-o-1.29.5-7.rhaos4.16.git7db4ada.el8.ppc64le.rpm
Red Hat Enterprise Linux	8	s390x	cri-o	1.29.5-7.rhaos4.16.git7db4ada.el8	cri-o-1.29.5-7.rhaos4.16.git7db4ada.el8.s390x.rpm
Red Hat Enterprise Linux	8	x86_64	cri-o	1.29.5-7.rhaos4.16.git7db4ada.el8	cri-o-1.29.5-7.rhaos4.16.git7db4ada.el8.x86_64.rpm
Red Hat Enterprise Linux	9	aarch64	cri-o	1.29.5-7.rhaos4.16.git7db4ada.el9	cri-o-1.29.5-7.rhaos4.16.git7db4ada.el9.aarch64.rpm
Red Hat Enterprise Linux	9	ppc64le	cri-o	1.29.5-7.rhaos4.16.git7db4ada.el9	cri-o-1.29.5-7.rhaos4.16.git7db4ada.el9.ppc64le.rpm
Red Hat Enterprise Linux	9	s390x	cri-o	1.29.5-7.rhaos4.16.git7db4ada.el9	cri-o-1.29.5-7.rhaos4.16.git7db4ada.el9.s390x.rpm
Red Hat Enterprise Linux	9	x86_64	cri-o	1.29.5-7.rhaos4.16.git7db4ada.el9	cri-o-1.29.5-7.rhaos4.16.git7db4ada.el9.x86_64.rpm
Red Hat Enterprise Linux	8	aarch64	cri-o-debuginfo	1.29.5-7.rhaos4.16.git7db4ada.el8	cri-o-debuginfo-1.29.5-7.rhaos4.16.git7db4ada.el8.aarch64.rpm
Red Hat Enterprise Linux	8	ppc64le	cri-o-debuginfo	1.29.5-7.rhaos4.16.git7db4ada.el8	cri-o-debuginfo-1.29.5-7.rhaos4.16.git7db4ada.el8.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2024-3727
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-3727
cve	www.cve.org/CVERecord

08 Oct 2026 14:56Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.18.3

EPSS0.01279

SSVC

containers image digest type invalid authenticated registry access resource exhaustion path traversal