CVE-2024-9407

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-9407
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-9407.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-9407
Aliases
Downstream
Related
Published
2024-10-01T20:13:29.588Z
Modified
2026-05-18T05:56:12.978395875Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction
Details

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9407.json",
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-20"
    ]
}
References

Affected packages

Git / github.com/containers/buildah

Affected ranges

Type
GIT
Repo
https://github.com/containers/buildah
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
df9247c59b2d44cb7b698fab124f2efe6a17032d
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.37.4"
        }
    ]
}

Affected versions

1.*
1.4
v0.*
v0.1
v0.10
v0.12
v0.15
v0.2
v0.3
v0.4
v0.5
v0.6
v0.7
v0.8
v1.*
v1.11.3
v1.11.4
v1.11.5
v1.13.2
v1.3
v1.37.0
v1.4
v1.5
v1.6
v1.7
v1.7.1
v1.7.2
v1.7.3
v1.8.0
v1.8.1
v1.8.2
v1.8.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-9407.json"

Git / github.com/containers/podman

Affected ranges

Type
GIT
Repo
https://github.com/containers/podman
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
76d0859d9f6e5d7c84392da9dcd2fae3447f789d
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.2.4"
        }
    ]
}

Affected versions

v0.*
v0.2
v0.2.1
v0.8.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-9407.json"