CVE-2024-9675

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9675.json",
    "cna_assigner": "redhat"
}

References

Affected packages

Git / github.com/containers/buildah

Affected ranges

Type

GIT

Repo

https://github.com/containers/buildah

Events

Introduced

Fixed

7aa3b5ee0470647fcf125930913132fe7c556bcd

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.38.0"
        }
    ]
}

Affected versions

1.*

1.4

v0.*

v0.1

v0.10

v0.12

v0.15

v0.2

v0.3

v0.4

v0.5

v0.6

v0.7

v0.8

v1.*

v1.11.3

v1.11.4

v1.11.5

v1.13.2

v1.3

v1.4

v1.5

v1.6

v1.7

v1.7.1

v1.7.2

v1.7.3

v1.8.0

v1.8.1

v1.8.2

v1.8.3

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-9675.json"