CVE-2024-3727

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-3727
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3727.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-3727
Aliases
Downstream
AZL (13)
BELL (1)
CGA (6)
CLEANSTART (1)
CLSA (1)
DEBIAN (1)
MGASA (1)
OESA (3)
openSUSE (12)
RHSA (9)
RLSA (2)
SUSE (20)
UBUNTU (1)
Related
ALSA (3)
openSUSE (12)
SUSE (20)
Published
2024-05-09T14:57:21Z
Modified
2026-09-21T03:30:33Z
Severity
  • 8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Containers/image: digest type does not guarantee valid type
Details

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

Database specific 
{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-354"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3727.json"
}
References

Affected packages

Git / github.com/containers/image

Affected ranges

Type
GIT
Repo
https://github.com/containers/image
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3e684b19a9ad1ae29c0de04bfab565a4cb609a55
Introduced
b29bde59df344f7cf3b379430d8d3534907495b6
Fixed
56e750a2cab2472740a8be66355401da5191d10b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "5.29.3"
        },
        {
            "introduced":  "5.30.0"
        },
        {
            "fixed":  "5.30.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

Other
v1,1
v1.*
v1.1
v1.2
v1.3
v1.4
v1.5.1
v5.*
v5.11.0
v5.2.0
v5.29.0
v5.30.0
v5.5.0
v5.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3727.json"