--- id: CVE-2024-3727 title: A flaw was found in the github.com/containers/image library summary: >- A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks. severity: high cvss: 8.3 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H' cwe: - CWE-354 vendor: Red Hat product: image affected: - image < 5.29.3 - image >= 5.30.0 < 5.30.1 - oadp/oadp-velero-plugin-rhel9 (all versions) - advanced-cluster-security/rhacs-central-db-rhel8 (all versions) - advanced-cluster-security/rhacs-collector-rhel8 (all versions) - advanced-cluster-security/rhacs-collector-slim-rhel8 (all versions) - advanced-cluster-security/rhacs-main-rhel8 (all versions) - advanced-cluster-security/rhacs-operator-bundle (all versions) - advanced-cluster-security/rhacs-rhel8-operator (all versions) - advanced-cluster-security/rhacs-roxctl-rhel8 (all versions) - advanced-cluster-security/rhacs-scanner-db-rhel8 (all versions) - advanced-cluster-security/rhacs-scanner-db-slim-rhel8 (all versions) - advanced-cluster-security/rhacs-scanner-rhel8 (all versions) - advanced-cluster-security/rhacs-scanner-slim-rhel8 (all versions) - advanced-cluster-security/rhacs-scanner-v4-db-rhel8 (all versions) - advanced-cluster-security/rhacs-scanner-v4-rhel8 (all versions) - advanced-cluster-security/rhacs-central-db-rhel8 (all versions) - advanced-cluster-security/rhacs-collector-rhel8 (all versions) - advanced-cluster-security/rhacs-collector-slim-rhel8 (all versions) - advanced-cluster-security/rhacs-main-rhel8 (all versions) - advanced-cluster-security/rhacs-operator-bundle (all versions) - advanced-cluster-security/rhacs-rhel8-operator (all versions) - advanced-cluster-security/rhacs-roxctl-rhel8 (all versions) - advanced-cluster-security/rhacs-scanner-db-rhel8 (all versions) - advanced-cluster-security/rhacs-scanner-db-slim-rhel8 (all versions) - advanced-cluster-security/rhacs-scanner-rhel8 (all versions) - advanced-cluster-security/rhacs-scanner-slim-rhel8 (all versions) - advanced-cluster-security/rhacs-scanner-v4-db-rhel8 (all versions) - advanced-cluster-security/rhacs-scanner-v4-rhel8 (all versions) - 'container-tools:rhel8 (all versions)' - buildah (all versions) - skopeo (all versions) - podman (all versions) - rhmtc/openshift-migration-controller-rhel8 (all versions) - podman (all versions) - skopeo (all versions) - openshift4/ose-operator-lifecycle-manager (all versions) - podman (all versions) - skopeo (all versions) - openshift4/network-tools-rhel8 (all versions) - openshift4/ose-agent-installer-api-server-rhel8 (all versions) - openshift4/ose-agent-installer-node-agent-rhel9 (all versions) - openshift4/ose-alibaba-machine-controllers-rhel9 (all versions) - openshift4/ose-apiserver-network-proxy-rhel9 (all versions) - openshift4/ose-cluster-autoscaler-rhel9-operator (all versions) - >- openshift4/ose-cluster-control-plane-machine-set-rhel9-operator (all versions) - openshift4/ose-cluster-ingress-rhel9-operator (all versions) - openshift4/ose-cluster-network-rhel9-operator (all versions) - openshift4/ose-cluster-node-tuning-rhel9-operator (all versions) - openshift4/ose-console (all versions) patched: - github.com/containers/image 5.30.1 - github.com/containers/image/v5 5.30.1 - github.com/containers/image/v5 5.29.3 published: '2024-05-14' updated: '2026-10-13' sourceUpdated: '2026-10-13T03:16:37.513' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-3727' references: - url: 'https://access.redhat.com/errata/RHSA-2024:0045' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:3718' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:4159' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:4613' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:4850' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:4960' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:5258' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:5951' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:6054' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:6122' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:6708' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:6818' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:6824' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:7164' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:7174' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:7182' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:7187' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:7922' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:7941' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:8260' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:8425' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:9097' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:9098' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:9102' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:9960' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2024-3727' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2274767' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:0045' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:4159' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:4613' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/security/cve/CVE-2024-3727' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2274767' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4HEYS34N55G7NOQZKNEXZKQVNDGEICCD/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6B37TXOKTKDBE2V26X2NSP7JKNMZOFVP/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYT3D2P3OJKISNFKOOHGY6HCUCQZYAVR/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLND3YDQQRWVRIUPL2G5UKXP5L3VSBBT/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DTOMYERG5ND4QFDHC4ZSGCED3T3ESRSC/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FBZQ2ZRMFEUQ35235B2HWPSXGDCBZHFV/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QFXMF3VVKIZN7ZMB7PKZCSWV6MOMTGMQ/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFVSMR7TNLO2KPWJSW4CF64C2QMQXCIN/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-3727' - url: >- https://github.com/containers/image/commit/132678b47bae29c710589012668cb85859d88385 - url: >- https://github.com/containers/image/commit/e8948046055060605bd68289d406ce149590c33a - url: 'https://github.com/advisories/GHSA-6wvf-f2vw-3425' - url: 'https://github.com/containers/image' - url: 'https://github.com/containers/image/releases/tag/v5.29.3' - url: 'https://github.com/containers/image/releases/tag/v5.30.1' - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4HEYS34N55G7NOQZKNEXZKQVNDGEICCD - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6B37TXOKTKDBE2V26X2NSP7JKNMZOFVP - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYT3D2P3OJKISNFKOOHGY6HCUCQZYAVR - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLND3YDQQRWVRIUPL2G5UKXP5L3VSBBT - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DTOMYERG5ND4QFDHC4ZSGCED3T3ESRSC - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FBZQ2ZRMFEUQ35235B2HWPSXGDCBZHFV - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QFXMF3VVKIZN7ZMB7PKZCSWV6MOMTGMQ - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFVSMR7TNLO2KPWJSW4CF64C2QMQXCIN tags: - nvd - cve.org - osv - go epss: 0.01279 epssPercentile: 0.69842 aliases: - GHSA-6wvf-f2vw-3425 - GO-2024-2842 ecosystem: go ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2024-05-13T17:59:41.318223Z' ingestedAt: '2026-06-30T09:49:12.322Z' --- ## Overview A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2024-3727) Affected packages: - `github.com/containers/image < 5.30.1` - `github.com/containers/image/v5 >= 5.30.0, < 5.30.1` - `github.com/containers/image/v5 < 5.29.3` Patched in: - `github.com/containers/image 5.30.1` - `github.com/containers/image/v5 5.30.1` - `github.com/containers/image/v5 5.29.3` Source: https://osv.dev/vulnerability/GHSA-6wvf-f2vw-3425