CVE-2024-9675

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-9675
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9675.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-9675
Aliases
Downstream
ALSA (5)
AZL (1)
BELL (1)
CGA (4)
CLEANSTART (1)
CLSA (1)
DEBIAN (1)
OESA (2)
openSUSE (4)
RHSA (16)
RLSA (2)
SUSE (8)
UBUNTU (1)
Related
ALSA (5)
openSUSE (4)
RLSA (1)
SUSE (8)
Published
2024-10-09T14:32:11Z
Modified
2026-10-28T02:30:40Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Buildah: buildah allows arbitrary directory mount
Details

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

Database specific 
{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9675.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "8100020241023085649.afee755d"
                        },
                        {
                            "fixed":  "8060020241028154646.3b538bd8"
                        },
                        {
                            "fixed":  "8060020241028154646.3b538bd8"
                        },
                        {
                            "fixed":  "8060020241028154646.3b538bd8"
                        },
                        {
                            "fixed":  "8080020241025064551.0f77c1b7"
                        },
                        {
                            "fixed":  "2:1.33.10-1.el9_4"
                        },
                        {
                            "fixed":  "4:4.9.4-16.el9_4"
                        },
                        {
                            "fixed":  "4:5.2.2-9.el9_5"
                        },
                        {
                            "fixed":  "2:1.37.5-1.el9_5"
                        },
                        {
                            "fixed":  "1:1.26.8-2.el9_0"
                        },
                        {
                            "fixed":  "2:4.2.0-5.el9_0.2"
                        },
                        {
                            "fixed":  "1:1.29.4-1.el9_2"
                        },
                        {
                            "fixed":  "2:4.4.1-21.el9_2"
                        },
                        {
                            "fixed":  "v4.12.0-202503181728.p0.ge355452.assembly.stream.el8"
                        },
                        {
                            "fixed":  "3:4.4.1-15.rhaos4.13.el8"
                        },
                        {
                            "fixed":  "v4.13.0-202503111300.p0.gb379980.assembly.stream.el8"
                        },
                        {
                            "fixed":  "3:4.4.1-21.rhaos4.14.el8"
                        },
                        {
                            "fixed":  "v4.14.0-202503060906.p0.gb03f3f5.assembly.stream.el8"
                        },
                        {
                            "fixed":  "3:4.4.1-32.rhaos4.15.el8"
                        },
                        {
                            "fixed":  "v4.15.0-202503060734.p0.gbc0b789.assembly.stream.el8"
                        },
                        {
                            "fixed":  "4:4.9.4-12.rhaos4.16.el8"
                        },
                        {
                            "fixed":  "v4.16.0-202503121138.p0.g31c3c26.assembly.stream.el9"
                        },
                        {
                            "fixed":  "5:5.2.2-1.rhaos4.17.el8"
                        },
                        {
                            "fixed":  "v4.17.0-202503041005.p0.gc3b0999.assembly.stream.el9"
                        },
                        {
                            "fixed":  "v4.18.0-202503040802.p0.g6a5ec2a.assembly.stream.el9"
                        },
                        {
                            "fixed":  "v3.13.2-1"
                        },
                        {
                            "fixed":  "v3.13.2-2"
                        },
                        {
                            "fixed":  "v3.13.2-1"
                        },
                        {
                            "fixed":  "v3.13.2-2"
                        },
                        {
                            "fixed":  "v3.13.2-4"
                        },
                        {
                            "fixed":  "v3.13.2-1"
                        },
                        {
                            "fixed":  "v3.13.2-1"
                        },
                        {
                            "fixed":  "v3.13.2-10"
                        },
                        {
                            "fixed":  "v3.13.2-1"
                        },
                        {
                            "fixed":  "v3.13.2-11"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "InverseAffectedRanges"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/podman-container-tools/buildah

Affected ranges

Type
GIT
Repo
https://github.com/podman-container-tools/buildah
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7aa3b5ee0470647fcf125930913132fe7c556bcd
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.38.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

1.*
1.4
v0.*
v0.1
v0.10
v0.12
v0.15
v0.2
v0.3
v0.4
v0.5
v0.6
v0.7
v0.8
v1.*
v1.11.3
v1.11.4
v1.11.5
v1.13.2
v1.3
v1.4
v1.5
v1.6
v1.7
v1.7.1
v1.7.2
v1.7.3
v1.8.0
v1.8.1
v1.8.2
v1.8.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9675.json"