CVE-2024-3727: Containers/image: digest type does not guarantee valid type
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
Other sources
Containers/image: digest type does not guarantee valid type
— Microsoft
The digest values, handled by the Go library github.com/opencontainers/go-digest and used throughout the Go-implemented containers ecosystem, are not always validated. That allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, resource exhaustion, local path traversal and other attacks.
References:
https://issues.redhat.com/browse/OCPBUGS-25269
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/containers/image/v5to a version that resolves this vulnerability.Fixed in 5.29.3 - Upgrade
Upgrade
go/github.com/containers/image/v5to a version that resolves this vulnerability.Fixed in 5.30.1 - Upgrade
Upgrade
go/github.com/containers/imageto a version that resolves this vulnerability.Fixed in 5.30.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3727?
CVE-2024-3727 has a high severity rating due to its potential for resource exhaustion and local path traversal attacks.
How do I fix CVE-2024-3727?
To fix CVE-2024-3727, update the github.com/containers/image library to version 5.29.3 or 5.30.1 or later.
What types of attacks can be performed using CVE-2024-3727?
CVE-2024-3727 can be exploited to trigger unexpected authenticated registry accesses, leading to resource exhaustion and local path traversal.
Which versions of github.com/containers/image are affected by CVE-2024-3727?
CVE-2024-3727 affects versions prior to 5.29.3 and between 5.30.0 and 5.30.1 of github.com/containers/image.
Is user authentication required for exploiting CVE-2024-3727?
Yes, exploitation of CVE-2024-3727 requires authenticated user access to the affected registry.