Bug 1224117 - VUL-0: CVE-2024-3727: buildah: containers/image: digest type does not guarantee valid type
Summary: VUL-0: CVE-2024-3727: buildah: containers/image: digest type does not guarant...
Status: IN_PROGRESS
Alias: None
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Danish Prakash
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/404878/
Whiteboard:
Keywords:
Depends on:
Blocks: CVE-2024-3727
  Show dependency tree / graph
 
Reported: 2024-05-10 11:37 UTC by Camila Camargo de Matos
Modified: 2024-06-14 13:36 UTC (History)
6 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---
camila.matos: needinfo? (danish.prakash)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Camila Camargo de Matos 2024-05-10 11:37:26 UTC 
+++ This bug was initially created as a clone of Bug #1224112 +++

The digest values, handled by the Go library github.com/opencontainers/go-digest and used throughout the Go-implemented containers ecosystem, are not always validated. That allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, resource exhaustion, local path traversal and other attacks.

References:

https://issues.redhat.com/browse/OCPBUGS-25269

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-3727
https://bugzilla.redhat.com/show_bug.cgi?id=2274767
Comment 1 Camila Camargo de Matos 2024-05-10 11:38:12 UTC 
The github.com/containers/image module is embedded in buildah. A fix for this issue can be found here: https://github.com/containers/image/pull/2403.
Comment 3 OBSbugzilla Bot 2024-05-13 07:45:02 UTC 
This is an autogenerated message for OBS integration:
This bug (1224117) was mentioned in
https://build.opensuse.org/request/show/1173582 Factory / buildah