CVE-2024-3727: Containers/image: digest type does not guarantee valid type

Severity: high (CVSS 8.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-09 · updated 2026-10-29
Weakness: CWE-354

Description

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

Affected products

image: before 5.29.3; from 5.30.0 before 5.30.1 — fixed in 5.29.3, 5.30.1
Red Hat OADP-1.3-RHEL-9: all versions — fixed in 1.3.4-9
Red Hat OpenShift Container Platform 4.18: all versions — fixed in v4.18.0-202502100934.p0.gc00c7c9.assembly.stream.el9
Red Hat OpenShift Developer Tools and Services: all versions
Red Hat OpenShift Serverless: all versions
Red Hat OpenShift Source-to-Image (S2I): all versions
Red Hat Advanced Cluster Security 3: all versions
Red Hat Advanced Cluster Security 4.4: all versions — fixed in 4.4.5-2
Red Hat Advanced Cluster Security 4.5: all versions — fixed in 4.5.2-2
Red Hat Enterprise Linux 8: all versions — fixed in 8100020240808093819.afee755d
Red Hat Enterprise Linux 9: all versions — fixed in 2:1.37.2-1.el9
Red Hat Migration Toolkit for Containers 1.8: all versions — fixed in v1.8.4-22
Red Hat OpenShift Container Platform 4.13: all versions — fixed in 3:4.4.1-13.rhaos4.13.el8
Red Hat OpenShift Container Platform 4.14: all versions — fixed in v4.14.0-202407260439.p0.g8d9b39e.assembly.stream.el8
Red Hat OpenShift Container Platform 4.15: all versions — fixed in v4.15.0-202409172305.p0.g17536c8.assembly.stream.el8
Red Hat OpenShift Container Platform 4.16: all versions — fixed in 4:4.9.4-5.1.rhaos4.16.el8
Red Hat OpenShift Container Platform 4.17: all versions — fixed in v4.17.0-202409122005.p0.gb170ad0.assembly.stream.el9
Red Hat OpenShift Container Platform Assisted Installer 1: all versions
Red Hat OpenShift Dev Spaces: all versions
Red Hat Openshift Sandboxed Containers: all versions
Red Hat OpenShift Virtualization 4: all versions
Red Hat OpenStack Platform 16.2: all versions
Red Hat RHEL-9-CNV-4.15: all versions — fixed in v4.15.5-7

How to fix

Upgrade to a fixed version: image 5.29.3, 5.30.1; Red Hat OADP-1.3-RHEL-9 1.3.4-9; Red Hat OpenShift Container Platform 4.18 v4.18.0-202502100934.p0.gc00c7c9.assembly.stream.el9; Red Hat Advanced Cluster Security 4.4 4.4.5-2; Red Hat Advanced Cluster Security 4.5 4.5.2-2; Red Hat Enterprise Linux 8 8100020240808093819.afee755d; Red Hat Enterprise Linux 9 2:1.37.2-1.el9; Red Hat Migration Toolkit for Containers 1.8 v1.8.4-22; Red Hat OpenShift Container Platform 4.13 3:4.4.1-13.rhaos4.13.el8; Red Hat OpenShift Container Platform 4.14 v4.14.0-202407260439.p0.g8d9b39e.assembly.stream.el8; Red Hat OpenShift Container Platform 4.15 v4.15.0-202409172305.p0.g17536c8.assembly.stream.el8; Red Hat OpenShift Container Platform 4.16 4:4.9.4-5.1.rhaos4.16.el8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-3727 or the next vulnerability affects your stack