Improper validation of integrity check value in Container Projects image library - CVE-2024-3727

 

Improper validation of integrity check value in Container Projects image library - CVE-2024-3727

Published: May 21, 2024


Vulnerability identifier: #VU89685
CSH Severity: Medium
CVSS v4 BT: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-3727
CWE-ID: CWE-354
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper validation of integrity check. A remote attacker can trick the victim into providing authenticated registry accesses, causing resource exhaustion, local path traversal, and other attacks.


Affected software

Container Projects image library
Podman
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Fedora
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
Containers Module
HPC Module
Basesystem Module
openSUSE Leap
openEuler
Container Projects skopeo
OpenShift Virtualization
buildah
Red Hat OpenShift Container Platform
Migration Toolkit for Containers
Guardium Data Security Center (GDSC)
PowerStore T
Robotic Process Automation for Cloud Pak
toolbox
toolbox-tests
toolbox (Red Hat package)
skopeo
skopeo-debuginfo
udica
conmon-rs (Red Hat package)
golang-github-prometheus-promu (Red Hat package)
butane (Red Hat package)
slirp4netns (Red Hat package)
runc (Red Hat package)
runc
slirp4netns
oci-seccomp-bpf-hook
apptainer
apptainer-sle15_7
apptainer-sle15_5
apptainer-leap
apptainer-sle15_6
apptainer-debuginfo
containernetworking-plugins (Red Hat package)
containernetworking-plugins
python-webob (Red Hat package)
aardvark-dns
fuse-overlayfs (Red Hat package)
netavark
skopeo (Red Hat package)
fuse-overlayfs
skopeo-tests
skopeo-debugsource
crun (Red Hat package)
crun
skopeo-bash-completion
skopeo-zsh-completion
skopeo-fish-completion
cri-o (Red Hat package)
cri-tools (Red Hat package)
libgpg-error0-32bit-debuginfo
libgpg-error-devel
libgpg-error0-32bit
libgpg-error-devel-debuginfo
libgpg-error-debugsource
libgpg-error0-debuginfo
libgpg-error0
buildah (Red Hat package)
buildah
buildah-tests
containerized-data-importer-uploadproxy-debuginfo
containerized-data-importer-uploadserver-debuginfo
containerized-data-importer-uploadproxy
containerized-data-importer-importer-debuginfo
containerized-data-importer-uploadserver
containerized-data-importer-importer
containerized-data-importer-operator
obs-service-cdi_containers_meta
containerized-data-importer-cloner-debuginfo
containerized-data-importer-manifests
containerized-data-importer-operator-debuginfo
containerized-data-importer-api
containerized-data-importer-api-debuginfo
containerized-data-importer-controller-debuginfo
containerized-data-importer-controller
containerized-data-importer-cloner
containers-common (Red Hat package)
containers-common
podman-cni-config
podman
conmon
conmon (Red Hat package)
haproxy (Red Hat package)
ignition (Red Hat package)
container-selinux (Red Hat package)
container-selinux
singularity-ce
python3-criu
criu-libs
criu-devel
crit
criu
libslirp
libslirp-devel
libslirp (Red Hat package)
podman (Red Hat package)
warewulf4
warewulf4-overlay-slurm
warewulf4-man
warewulf4-overlay
python3-podman
podman-docker
podman-catatonit
podman-gvproxy
podman-plugins
podman-remote
podman-tests
podman-debuginfo
podman-remote-debuginfo
podmansh
openshift-ansible (Red Hat package)
ose-gcp-gcr-image-credential-provider (Red Hat package)
openshift4-aws-iso (Red Hat package)
ose-azure-acr-image-credential-provider (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
openstack-ironic (Red Hat package)
ovn24.03 (Red Hat package)
docker-zsh-completion
docker-bash-completion
docker-fish-completion
docker-rootless-extras
docker-debuginfo
docker
cockpit-podman
ostree (Red Hat package)
IBM Concert Software
APEX Cloud Platform for Red Hat OpenShift
Red Hat OpenShift Dev Spaces
Red Hat Advanced Cluster Security for Kubernetes
IBM Cloud Pak for Business Automation
OpenShift API for Data Protection (OADP)

How to mitigate CVE-2024-3727

Install updates from vendor's website.

Container Projects image library - addressed in versions 5.29.3, 5.30.1
Container Projects skopeo - update to 1.14.4
buildah - update to 1.33.8
Guardium Data Security Center (GDSC) - update to 3.7.2
Podman - update to 4.9.5
Red Hat OpenShift Container Platform - addressed in versions 4.13.46, 4.13.52, 4.14.34, 4.14.38, 4.14.39, 4.15.24, 4.15.35, 4.15.37, 4.16.0, 4.16.1, 4.16.14, 4.16.15, 4.16.18, 4.17.0, 4.17.1
toolbox - update to 0.0.99.5-2.0.1
toolbox-tests - update to 0.0.99.5-2.0.1
toolbox (Red Hat package) - addressed in versions 0.1.0-2.rhaos4.16.el8, 0.1.2-1.rhaos4.16.el9
skopeo - addressed in versions 0.1.41-150000.4.23.1, 1.14.4-150000.4.26.1, 1.14.4-150300.11.11.1
skopeo-debuginfo - addressed in versions 0.1.41-150000.4.23.1, 1.14.4-150000.4.26.1, 1.14.4-150300.11.11.1
udica - update to 0.2.6-21
conmon-rs (Red Hat package) - addressed in versions 0.6.3-1.rhaos4.16.el8, 0.6.3-1.rhaos4.16.el9
golang-github-prometheus-promu (Red Hat package) - update to 0.15.0-15.2.gitd5383c5.el9
butane (Red Hat package) - update to 0.21.0-1.rhaos4.16.el8
IBM Concert Software - update to 1.0.1
slirp4netns (Red Hat package) - update to 1.1.8-2.rhaos4.16.el8
runc (Red Hat package) - addressed in versions 1.1.12-3.1.rhaos4.16.el8, 1.1.12-3.1.rhaos4.16.el9, 1.1.14-1.rhaos4.14.el8, 1.1.14-1.rhaos4.14.el9
runc - update to 1.1.12-4.0.1
slirp4netns - update to 1.2.3-1
oci-seccomp-bpf-hook - update to 1.2.10-1
apptainer - addressed in versions 1.3.2-1.el7, 1.3.2-1.el8, 1.3.2-1.el9, 1.3.2-1.fc39, 1.3.2-1.fc40
OpenShift API for Data Protection (OADP) - update to 1.3.4
apptainer-sle15_7 - update to 1.3.6-150600.4.6.1
apptainer-sle15_5 - update to 1.3.6-150600.4.6.1
apptainer-leap - update to 1.3.6-150600.4.6.1
apptainer-sle15_6 - update to 1.3.6-150600.4.6.1
apptainer - update to 1.3.6-150600.4.6.1
apptainer-debuginfo - update to 1.3.6-150600.4.6.1
containernetworking-plugins (Red Hat package) - addressed in versions 1.4.0-2.1.rhaos4.16.el8, 1.4.0-4.rhaos4.13.el8
containernetworking-plugins - update to 1.4.0-5.0.1
Migration Toolkit for Containers - update to 1.8.4
python-webob (Red Hat package) - update to 1.8.8-2.el9
aardvark-dns - update to 1.10.0-2.0.1
fuse-overlayfs (Red Hat package) - update to 1.10-2.rhaos4.16.el8
netavark - update to 1.10.3-1.0.1
skopeo (Red Hat package) - addressed in versions 1.11.3-3.rhaos4.13.el8, 1.11.3-3.rhaos4.13.el9, 1.11.3-3.rhaos4.14.el8, 1.11.3-3.rhaos4.14.el9, 1.11.3-4.rhaos4.15.el8, 1.11.3-4.rhaos4.15.el9, 1.14.4-1.rhaos4.16.el8, 1.14.4-1.rhaos4.16.el9, 1.16.1-1.el9
fuse-overlayfs - update to 1.13-1.0.1
skopeo - update to 1.14.2-6
skopeo-tests - update to 1.14.2-6
skopeo-debugsource - update to 1.14.2-6
skopeo-debuginfo - update to 1.14.2-6
crun (Red Hat package) - addressed in versions 1.14.3-1.rhaos4.16.el8, 1.14.3-1.rhaos4.16.el9, 1.17-1.rhaos4.14.el8, 1.17-1.rhaos4.14.el9
crun - update to 1.14.3-2
skopeo-bash-completion - update to 1.14.4-150300.11.11.1
skopeo-zsh-completion - update to 1.14.4-150300.11.11.1
skopeo-fish-completion - update to 1.14.4-150300.11.11.1
skopeo-tests - update to 1.14.5-3.0.1
skopeo - addressed in versions 1.14.5-3.0.1, 1.17.0-2
cri-o (Red Hat package) - addressed in versions 1.26.5-23.rhaos4.13.git6d9c688.el8, 1.26.5-23.rhaos4.13.git6d9c688.el9, 1.27.8-8.rhaos4.14.git17cbe6d.el8, 1.27.8-8.rhaos4.14.git17cbe6d.el9, 1.28.10-5.rhaos4.15.git7a788e6.el8, 1.28.10-5.rhaos4.15.git7a788e6.el9, 1.29.5-5.rhaos4.16.git7032128.el8, 1.29.5-5.rhaos4.16.git7032128.el9, 1.29.5-7.rhaos4.16.git7db4ada.el8, 1.29.5-7.rhaos4.16.git7db4ada.el9
cri-tools (Red Hat package) - addressed in versions 1.29.0-3.1.el8, 1.29.0-3.1.el9
libgpg-error0-32bit-debuginfo - update to 1.29-150000.3.3.1
libgpg-error-devel - update to 1.29-150000.3.3.1
libgpg-error0-32bit - update to 1.29-150000.3.3.1
libgpg-error-devel-debuginfo - update to 1.29-150000.3.3.1
libgpg-error-debugsource - update to 1.29-150000.3.3.1
libgpg-error0-debuginfo - update to 1.29-150000.3.3.1
libgpg-error0 - update to 1.29-150000.3.3.1
buildah (Red Hat package) - addressed in versions 1.33.7-1.1.rhaos4.16.el8, 1.33.7-1.1.rhaos4.16.el9, 1.37.2-1.el9
buildah - update to 1.34.0-1
buildah-tests - update to 1.34.0-1
buildah - addressed in versions 1.35.4-1.fc38, 1.35.4-1.fc39, 1.35.4-1.fc40
buildah - addressed in versions 1.35.4-150300.8.25.1, 1.35.4-150400.3.30.1, 1.35.4-150500.3.10.1
containerized-data-importer-uploadproxy-debuginfo - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
containerized-data-importer-uploadserver-debuginfo - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
containerized-data-importer-uploadproxy - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
containerized-data-importer-importer-debuginfo - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
containerized-data-importer-uploadserver - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
containerized-data-importer-importer - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
containerized-data-importer-operator - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
obs-service-cdi_containers_meta - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
containerized-data-importer-cloner-debuginfo - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
containerized-data-importer-manifests - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
containerized-data-importer-operator-debuginfo - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
containerized-data-importer-api - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
containerized-data-importer-api-debuginfo - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
containerized-data-importer-controller-debuginfo - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
containerized-data-importer-controller - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
containerized-data-importer-cloner - addressed in versions 1.58.0-150500.6.15.1, 1.58.0-150600.3.3.2
containers-common (Red Hat package) - addressed in versions 1-77.rhaos4.16.el8, 1-77.rhaos4.16.el9
containers-common - update to 1-82.0.1
podman-cni-config - update to 2.1.1-150100.4.31.1
podman - addressed in versions 2.1.1-150100.4.31.1, 4.9.5-150300.9.31.1, 4.9.5-150400.4.27.1, 4.9.5-150500.3.12.1
conmon - update to 2.1.10-1
conmon (Red Hat package) - addressed in versions 2.1.10-2.1.rhaos4.16.el8, 2.1.10-2.1.rhaos4.16.el9
haproxy (Red Hat package) - addressed in versions 2.6.13-3.rhaos4.16.el8, 2.8.5-2.rhaos4.16.el9
ignition (Red Hat package) - update to 2.18.0-2.1.rhaos4.16.el9
container-selinux (Red Hat package) - addressed in versions 2.228.1-1.rhaos4.13.el8, 2.228.1-1.rhaos4.13.el9, 2.231.0-1.rhaos4.16.el8, 2.231.0-1.rhaos4.16.el9
container-selinux - update to 2.229.0-2
APEX Cloud Platform for Red Hat OpenShift - update to 03.01.02.00
PowerStore T - update to 3.6.1.4-2413340
singularity-ce - update to 3.11.5^20240603gbd4675f-1.fc39
Red Hat OpenShift Dev Spaces - update to 3.17.0
python3-criu - update to 3.18-5.0.1
criu-libs - update to 3.18-5.0.1
criu-devel - update to 3.18-5.0.1
crit - update to 3.18-5.0.1
criu - update to 3.18-5.0.1
libslirp - update to 4.4.0-2
libslirp-devel - update to 4.4.0-2
libslirp (Red Hat package) - update to 4.4.0-4.rhaos4.16.el8
podman (Red Hat package) - addressed in versions 4.4.1-13.rhaos4.13.el8, 4.4.1-14.rhaos4.13.el9, 4.4.1-19.rhaos4.14.el8, 4.4.1-19.rhaos4.14.el9, 4.4.1-30.rhaos4.15.el8, 4.4.1-30.rhaos4.15.el9, 4.9.4-5.1.rhaos4.16.el8, 4.9.4-5.1.rhaos4.16.el9, 5.2.2-1.el9
Red Hat Advanced Cluster Security for Kubernetes - update to 4.5.2
warewulf4 - update to 4.5.2-150500.6.13.1
warewulf4-overlay-slurm - update to 4.5.2-150500.6.13.1
warewulf4-man - update to 4.5.2-150500.6.13.1
warewulf4-overlay - update to 4.5.2-150500.6.13.1
python3-podman - update to 4.9.0-2
podman-docker - update to 4.9.4-12.0.1
podman - update to 4.9.4-12.0.1
podman-catatonit - update to 4.9.4-12.0.1
podman-gvproxy - update to 4.9.4-12.0.1
podman-plugins - update to 4.9.4-12.0.1
podman-remote - update to 4.9.4-12.0.1
podman-tests - update to 4.9.4-12.0.1
podman-debuginfo - addressed in versions 4.9.5-150300.9.31.1, 4.9.5-150400.4.27.1, 4.9.5-150500.3.12.1
podman-remote-debuginfo - addressed in versions 4.9.5-150300.9.31.1, 4.9.5-150400.4.27.1, 4.9.5-150500.3.12.1
podman-remote - addressed in versions 4.9.5-150300.9.31.1, 4.9.5-150400.4.27.1, 4.9.5-150500.3.12.1
podmansh - addressed in versions 4.9.5-150300.9.31.1, 4.9.5-150400.4.27.1, 4.9.5-150500.3.12.1
podman-docker - addressed in versions 4.9.5-150300.9.31.1, 4.9.5-150400.4.27.1, 4.9.5-150500.3.12.1
openshift-ansible (Red Hat package) - addressed in versions 4.14.0-202409061409.p0.g846e89b.assembly.stream.el8, 4.14.0-202409061409.p0.g846e89b.assembly.stream.el9, 4.16.0-202404181812.p0.g7806532.assembly.stream.el8, 4.16.0-202404181812.p0.g7806532.assembly.stream.el9
OpenShift Virtualization - update to 4.15.5
ose-gcp-gcr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202404181812.p0.g26b43df.assembly.stream.el8, 4.16.0-202404181812.p0.g26b43df.assembly.stream.el9
openshift4-aws-iso (Red Hat package) - update to 4.16.0-202404181812.p0.gd2acdd5.assembly.stream.el8
ose-azure-acr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202404301345.p0.g0e95532.assembly.stream.el8, 4.16.0-202404301345.p0.g0e95532.assembly.stream.el9
ose-aws-ecr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202405311136.p0.ga53e9de.assembly.stream.el8, 4.16.0-202405311136.p0.ga53e9de.assembly.stream.el9
openshift-clients (Red Hat package) - addressed in versions 4.16.0-202406052127.p0.ga245041.assembly.stream.el8, 4.16.0-202406052127.p0.ga245041.assembly.stream.el9
openshift (Red Hat package) - addressed in versions 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8, 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9, 4.16.0-202406191607.p0.g58452d8.assembly.stream.el8, 4.16.0-202406191607.p0.g58452d8.assembly.stream.el9
podman - update to 5.0.3-1.fc40
kernel (Red Hat package) - addressed in versions 5.14.0-284.86.1.el9_2, 5.14.0-284.88.1.el9_2, 5.14.0-427.24.1.el9_4
kernel-rt (Red Hat package) - addressed in versions 5.14.0-284.86.1.rt14.371.el9_2, 5.14.0-284.88.1.rt14.373.el9_2
openstack-ironic-python-agent (Red Hat package) - update to 9.3.1-0.20240911165036.dfceb59.el9
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.18, 23.0.19
openstack-ironic (Red Hat package) - update to 21.3.1-0.20240911165036.c0d61d0.el9
ovn24.03 (Red Hat package) - update to 24.03.2-19.el9fdp
docker-zsh-completion - update to 25.0.6_ce-150000.207.1
docker-bash-completion - update to 25.0.6_ce-150000.207.1
docker-fish-completion - update to 25.0.6_ce-150000.207.1
docker-rootless-extras - update to 25.0.6_ce-150000.207.1
docker-debuginfo - update to 25.0.6_ce-150000.207.1
docker - update to 25.0.6_ce-150000.207.1
cockpit-podman - update to 84.1-1
ostree (Red Hat package) - update to 2024.1-2.el9

External References

Related Security Bulletins