CVE-2024-9341
Medium
Description
A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.
SeverityMedium
CVSS5.4
Exploit probability—
Product
Containers Common
PublishedOct 1, 2024
First seenOct 1, 2024
Weakness typeCWE-59Improper link resolution
How to fix
Update
- github.com/containers/common0.60.4 or later
Vendor advisories
- access.redhat.com/errata/RHEA-2024:6126
- access.redhat.com/errata/RHSA-2024:10147
- access.redhat.com/errata/RHSA-2024:10818
- access.redhat.com/errata/RHSA-2024:6122
- access.redhat.com/errata/RHSA-2024:7925
- access.redhat.com/errata/RHSA-2024:8039
- access.redhat.com/errata/RHSA-2024:8112
- access.redhat.com/errata/RHSA-2024:8238
- access.redhat.com/errata/RHSA-2024:8263
- access.redhat.com/errata/RHSA-2024:8428
- access.redhat.com/errata/RHSA-2024:8690
- access.redhat.com/errata/RHSA-2024:8694
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| containers common | No range specified | — |
| redhat openshift_container_platform | 4.12, 4.13, 4.14, 4.15, 4.16, 4.17 | — |
| redhat enterprise_linux | 8.0, 9.0 | — |
| github.com/containers/commonGo | v < 0.60.4 | 0.60.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.