CVE-2024-3727

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-3727
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-3727.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-3727
Aliases
Downstream
AZL (13)
BELL (1)
CGA (6)
CLEANSTART (1)
CLSA (1)
DEBIAN (1)
MGASA (1)
OESA (3)
openSUSE (12)
RHSA (9)
RLSA (2)
SUSE (20)
UBUNTU (1)
Related
ALSA (3)
openSUSE (12)
SUSE (20)
Published
2024-05-09T14:57:21Z
Modified
2026-10-16T02:35:31Z
Severity
  • 8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Containers/image: digest type does not guarantee valid type
Details

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

Database specific 
{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-354"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3727.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "1.3.4-9"
                        },
                        {
                            "fixed": "4.4.5-2"
                        },
                        {
                            "fixed": "4.4.5-2"
                        },
                        {
                            "fixed": "4.4.5-2"
                        },
                        {
                            "fixed": "4.4.5-4"
                        },
                        {
                            "fixed": "4.4.5-3"
                        },
                        {
                            "fixed": "4.4.5-2"
                        },
                        {
                            "fixed": "4.4.5-2"
                        },
                        {
                            "fixed": "4.4.5-2"
                        },
                        {
                            "fixed": "4.4.5-3"
                        },
                        {
                            "fixed": "4.4.5-2"
                        },
                        {
                            "fixed": "4.4.5-2"
                        },
                        {
                            "fixed": "4.4.5-3"
                        },
                        {
                            "fixed": "4.4.5-3"
                        },
                        {
                            "fixed": "4.5.2-2"
                        },
                        {
                            "fixed": "4.5.2-2"
                        },
                        {
                            "fixed": "4.5.2-2"
                        },
                        {
                            "fixed": "4.5.2-2"
                        },
                        {
                            "fixed": "4.5.2-2"
                        },
                        {
                            "fixed": "4.5.2-2"
                        },
                        {
                            "fixed": "4.5.2-2"
                        },
                        {
                            "fixed": "4.5.2-2"
                        },
                        {
                            "fixed": "4.5.2-2"
                        },
                        {
                            "fixed": "4.5.2-2"
                        },
                        {
                            "fixed": "4.5.2-1"
                        },
                        {
                            "fixed": "4.5.2-2"
                        },
                        {
                            "fixed": "4.5.2-2"
                        },
                        {
                            "fixed": "8100020240808093819.afee755d"
                        },
                        {
                            "fixed": "2:1.37.2-1.el9"
                        },
                        {
                            "fixed": "2:1.16.1-1.el9"
                        },
                        {
                            "fixed": "2:5.2.2-1.el9"
                        },
                        {
                            "fixed": "v1.8.4-22"
                        },
                        {
                            "fixed": "3:4.4.1-13.rhaos4.13.el8"
                        },
                        {
                            "fixed": "2:1.11.3-3.rhaos4.13.el8"
                        },
                        {
                            "fixed": "v4.14.0-202407260439.p0.g8d9b39e.assembly.stream.el8"
                        },
                        {
                            "fixed": "3:4.4.1-19.rhaos4.14.el8"
                        },
                        {
                            "fixed": "2:1.11.3-3.rhaos4.14.el8"
                        },
                        {
                            "fixed": "v4.15.0-202409172305.p0.g17536c8.assembly.stream.el8"
                        },
                        {
                            "fixed": "v4.15.0-202409171307.p0.ged4651a.assembly.stream.el8"
                        },
                        {
                            "fixed": "v4.15.0-202409161436.p0.g1f44c02.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409120135.p0.gf7f5eed.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409131835.p0.gadccbd5.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409120135.p0.g8425d88.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409130735.p0.gc03231f.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409131635.p0.gb73e37f.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409161836.p0.g092d15b.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409180105.p0.g1fdd5b0.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409180905.p0.gf6f61ca.assembly.stream.el8"
                        },
                        {
                            "fixed": "v4.15.0-202409171307.p0.g160e7ca.assembly.stream.el8"
                        },
                        {
                            "fixed": "v4.15.0-202409131635.p0.gb7c1d6a.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409111636.p0.gf0c44f6.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409120135.p0.g3ab953d.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409111636.p0.g9ea52de.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409111636.p0.gd80fe46.assembly.stream.el8"
                        },
                        {
                            "fixed": "v4.15.0-202409120135.p0.g8de6f94.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409171307.p0.g5d529dd.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409180305.p0.g1da79fe.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409180305.p0.g1da79fe.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409172305.p0.g5af0be8.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409172305.p0.g5af0be8.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409130536.p0.g1d6a7ed.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409161436.p0.g4121cfc.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409120135.p0.g71a6f28.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409180705.p0.g95ee44e.assembly.stream.el8"
                        },
                        {
                            "fixed": "v4.15.0-202409161234.p0.g4e8d689.assembly.stream.el8"
                        },
                        {
                            "fixed": "415.92.202409162258-0"
                        },
                        {
                            "fixed": "415.92.202409162258-0"
                        },
                        {
                            "fixed": "3:4.4.1-30.rhaos4.15.el8"
                        },
                        {
                            "fixed": "2:1.11.3-4.rhaos4.15.el8"
                        },
                        {
                            "fixed": "v4.15.0-202410230304.p0.g366295f.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202410230304.p0.gfde2b2e.assembly.stream.el8"
                        },
                        {
                            "fixed": "v4.15.0-202407230407.p0.gf3f8de5.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409172305.p0.g17536c8.assembly.stream.el8"
                        },
                        {
                            "fixed": "v4.15.0-202409171307.p0.ged4651a.assembly.stream.el8"
                        },
                        {
                            "fixed": "v4.15.0-202409161436.p0.g1f44c02.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409120135.p0.gf7f5eed.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409131835.p0.gadccbd5.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409120135.p0.g8425d88.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409130735.p0.gc03231f.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409131635.p0.gb73e37f.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409161836.p0.g092d15b.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409180105.p0.g1fdd5b0.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409180905.p0.gf6f61ca.assembly.stream.el8"
                        },
                        {
                            "fixed": "v4.15.0-202409171307.p0.g160e7ca.assembly.stream.el8"
                        },
                        {
                            "fixed": "v4.15.0-202409131635.p0.gb7c1d6a.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409111636.p0.gf0c44f6.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409120135.p0.g3ab953d.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409111636.p0.g9ea52de.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409111636.p0.gd80fe46.assembly.stream.el8"
                        },
                        {
                            "fixed": "v4.15.0-202409120135.p0.g8de6f94.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409171307.p0.g5d529dd.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409180305.p0.g1da79fe.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409180305.p0.g1da79fe.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409172305.p0.g5af0be8.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409172305.p0.g5af0be8.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409130536.p0.g1d6a7ed.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409161436.p0.g4121cfc.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409120135.p0.g71a6f28.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.0-202409180705.p0.g95ee44e.assembly.stream.el8"
                        },
                        {
                            "fixed": "v4.15.0-202409161234.p0.g4e8d689.assembly.stream.el8"
                        },
                        {
                            "fixed": "415.92.202409162258-0"
                        },
                        {
                            "fixed": "4:4.9.4-5.1.rhaos4.16.el8"
                        },
                        {
                            "fixed": "2:1.14.4-1.rhaos4.16.el8"
                        },
                        {
                            "fixed": "0:1.29.5-7.rhaos4.16.git7db4ada.el8"
                        },
                        {
                            "fixed": "v4.16.0-202407171536.p0.g1551101.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.16.0-202409162206.p0.g6a425ab.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.16.0-202409231504.p0.g342902b.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.16.0-202410172201.p0.gb121e87.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.17.0-202409122005.p0.gb170ad0.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.17.0-202409100034.p0.g8d16b39.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.17.0-202409101338.p0.gb0d86a0.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.17.0-202409101338.p0.gb0d86a0.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.17.0-202410022234.p0.gfbc55c6.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.18.0-202502100934.p0.gc00c7c9.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.18.0-202502040032.p0.ge5a4005.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.18.0-202502041302.p0.g51a74ac.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.18.0-202501230001.p0.g5348c85.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.18.0-202502100153.p0.g120ba67.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.18.0-202502060238.p0.g73d65db.assembly.stream.el9"
                        },
                        {
                            "fixed": "v4.15.5-7"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "InverseAffectedRanges"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/containers/image

Affected ranges

Type
GIT
Repo
https://github.com/containers/image
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3e684b19a9ad1ae29c0de04bfab565a4cb609a55
Introduced
b29bde59df344f7cf3b379430d8d3534907495b6
Fixed
56e750a2cab2472740a8be66355401da5191d10b
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "5.29.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "5.30.0"
                },
                {
                    "fixed": "5.30.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

Other
v1,1
v1.*
v1.1
v1.2
v1.3
v1.4
v1.5.1
v5.*
v5.11.0
v5.2.0
v5.29.0
v5.30.0
v5.5.0
v5.6.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-3727.json"