Buildah allows arbitrary directory mount

TRUNG BÌNH 4.4CVE-2024-9675 · GHSA-586p-749j-fhwp · GO-2024-3186 · Công bố 09/10/2024 · cập nhật 30/10/2026

Tóm tắt nhanh

CVE-2024-9675 là lỗ hổng mức TRUNG BÌNH (CVSS 4.4) ảnh hưởng github.com/containers/buildah, openshift container platform (redhat).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.39%, cao hơn 33.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.37.1, 1.38.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/containers/buildah Go	`< 1.37.1< 1.38.0`	`1.37.11.38.0`
openshift container platform redhat	`= 4.13= 4.14= 4.15= 4.16= 4.17`	Chưa có bản vá

Mô tả

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

Mô tả của NVD

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.