CVE-2024-9675
HIGHDescription
A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.
Is your site exposed to CVE-2024-9675?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| buildah_project | buildah |
| redhat | openshift_container_platform |
| redhat | openshift_container_platform |
| redhat | openshift_container_platform |
| redhat | openshift_container_platform |
| redhat | openshift_container_platform |
| redhat | enterprise_linux |
| redhat | enterprise_linux |
| redhat | enterprise_linux_eus |
| redhat | enterprise_linux_eus |
| redhat | enterprise_linux_eus |
| redhat | enterprise_linux_eus |
| redhat | enterprise_linux_for_arm_64 |
| redhat | enterprise_linux_for_arm_64 |
| redhat | enterprise_linux_for_arm_64_eus |
| redhat | enterprise_linux_for_arm_64_eus |
| redhat | enterprise_linux_for_arm_64_eus |
| redhat | enterprise_linux_for_arm_64_eus |
| redhat | enterprise_linux_for_ibm_z_systems |
| redhat | enterprise_linux_for_ibm_z_systems |
| redhat | enterprise_linux_for_ibm_z_systems_eus |
| redhat | enterprise_linux_for_ibm_z_systems_eus |
| redhat | enterprise_linux_for_ibm_z_systems_eus |
| redhat | enterprise_linux_for_ibm_z_systems_eus |
| redhat | enterprise_linux_for_power_little_endian |
| redhat | enterprise_linux_for_power_little_endian |
| redhat | enterprise_linux_for_power_little_endian_eus |
| redhat | enterprise_linux_for_power_little_endian_eus |
| redhat | enterprise_linux_for_power_little_endian_eus |
| redhat | enterprise_linux_for_power_little_endian_eus |
| redhat | enterprise_linux_server_aus |
| redhat | enterprise_linux_server_aus |
| redhat | enterprise_linux_server_aus |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions |
| redhat | enterprise_linux_server_tus |
| redhat | enterprise_linux_server_tus |
| redhat | enterprise_linux_update_services_for_sap_solutions |
| redhat | enterprise_linux_update_services_for_sap_solutions |
| redhat | enterprise_linux_update_services_for_sap_solutions |
| redhat | enterprise_linux_update_services_for_sap_solutions |
| redhat | enterprise_linux_update_services_for_sap_solutions |
References
Other References
Frequently Asked Questions
What is CVE-2024-9675? +
How severe is CVE-2024-9675? +
What products are affected by CVE-2024-9675? +
How do I check if I'm vulnerable to CVE-2024-9675? +
Related Vulnerabilities
Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior …
Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys read from build/packages/packages.toml …
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.1, a path traversal …
Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path …
Kenik Camera management Panel is vulnerable to Path Traversal vulnerability. An unauthenticated attacker can send GET request with arbitrary file …
Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to …