Bug 1224112 (CVE-2024-3727)

Summary:	VUL-0: CVE-2024-3727: TRACKERBUG: containers/image: digest type does not guarantee valid type
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P2 - High	CC:	camila.matos
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/404878/
Whiteboard:	CVSSv3.1:SUSE:CVE-2024-3727:8.3:(AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:	1224117, 1224119, 1224122, 1224123, 1224125, 1224126, 1224128, 1224114, 1224124, 1224129
Bug Blocks:

Description SMASH SMASH 2024-05-10 11:08:10 UTC

The digest values, handled by the Go library github.com/opencontainers/go-digest and used throughout the Go-implemented containers ecosystem, are not always validated. That allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, resource exhaustion, local path traversal and other attacks.

References:

https://issues.redhat.com/browse/OCPBUGS-25269

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-3727
https://bugzilla.redhat.com/show_bug.cgi?id=2274767

Comment 1 Camila Camargo de Matos 2024-05-10 11:09:13 UTC

PR with fix: https://github.com/containers/image/pull/2403