← CVE Intelligence

CVE-2024-9675

Buildah: buildah allows arbitrary directory mount PUBLISHED

Description (CNA)

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

Affected (CNA)

Vendor / productVersions
Not supplied / Not suppliedaffected 0 before 1.38.0
Red Hat / Red Hat Enterprise Linux 8unaffected 8100020241023085649.afee755d before *
Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 8060020241028154646.3b538bd8 before *
Red Hat / Red Hat Enterprise Linux 8.6 Telecommunications Update Serviceunaffected 8060020241028154646.3b538bd8 before *
Red Hat / Red Hat Enterprise Linux 8.6 Update Services for SAP Solutionsunaffected 8060020241028154646.3b538bd8 before *
Red Hat / Red Hat Enterprise Linux 8.8 Extended Update Supportunaffected 8080020241025064551.0f77c1b7 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 2:1.33.10-1.el9_4 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 4:4.9.4-16.el9_4 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 4:5.2.2-9.el9_5 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 2:1.37.5-1.el9_5 before *
Red Hat / Red Hat Enterprise Linux 9.0 Extended Update Supportunaffected 1:1.26.8-2.el9_0 before *
Red Hat / Red Hat Enterprise Linux 9.0 Extended Update Supportunaffected 2:4.2.0-5.el9_0.2 before *
Red Hat / Red Hat Enterprise Linux 9.2 Extended Update Supportunaffected 1:1.29.4-1.el9_2 before *
Red Hat / Red Hat Enterprise Linux 9.2 Extended Update Supportunaffected 2:4.4.1-21.el9_2 before *
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected v4.12.0-202503181728.p0.ge355452.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 3:4.4.1-15.rhaos4.13.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected v4.13.0-202503111300.p0.gb379980.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 3:4.4.1-21.rhaos4.14.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202503060906.p0.gb03f3f5.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 3:4.4.1-32.rhaos4.15.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected v4.15.0-202503060734.p0.gbc0b789.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.16unaffected 4:4.9.4-12.rhaos4.16.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.16unaffected v4.16.0-202503121138.p0.g31c3c26.assembly.stream.el9 before *
Red Hat / Red Hat OpenShift Container Platform 4.17unaffected 5:5.2.2-1.rhaos4.17.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.17unaffected v4.17.0-202503041005.p0.gc3b0999.assembly.stream.el9 before *
Red Hat / Red Hat OpenShift Container Platform 4.18unaffected v4.18.0-202503040802.p0.g6a5ec2a.assembly.stream.el9 before *
Red Hat / Red Hat Quay 3unaffected v3.13.2-1 before *
Red Hat / Red Hat Quay 3unaffected v3.13.2-2 before *
Red Hat / Red Hat Quay 3unaffected v3.13.2-1 before *
Red Hat / Red Hat Quay 3unaffected v3.13.2-2 before *
Red Hat / Red Hat Quay 3unaffected v3.13.2-4 before *
Red Hat / Red Hat Quay 3unaffected v3.13.2-1 before *
Red Hat / Red Hat Quay 3unaffected v3.13.2-1 before *
Red Hat / Red Hat Quay 3unaffected v3.13.2-10 before *
Red Hat / Red Hat Quay 3unaffected v3.13.2-1 before *
Red Hat / Red Hat Quay 3unaffected v3.13.2-11 before *
Red Hat / OpenShift Developer Tools and Servicesaffected
Red Hat / OpenShift Developer Tools and Servicesaffected
Red Hat / Red Hat Enterprise Linux 10unaffected
Red Hat / Red Hat Enterprise Linux 10unaffected
Red Hat / Red Hat Enterprise Linux 7unknown
Red Hat / Red Hat Enterprise Linux 9unaffected
Red Hat / Red Hat OpenShift Container Platform 4unaffected
Red Hat / Red Hat OpenShift Container Platform 4affected
Red Hat / Red Hat OpenShift Container Platform 4unaffected

CWE

CWE-22

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.