Red Hat Security Advisory: buildah security update

Fixed packages 5

Vulnerabilities 7

• High 7.8
  CVE-2024-9675

  Buildah: buildah allows arbitrary directory mount

  A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) int…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Linux Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 9, 2024
• High 7.5
  CVE-2024-34156

  Stack exhaustion in Decoder.Decode in encoding/gob

  Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

  Go standard library encoding/gob katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2024
• High 7.5
  CVE-2024-34158

  Stack exhaustion in Parse in go/build/constraint

  Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

  Go standard library go/build/constraint katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2024
• Medium 6.5
  CVE-2024-9676

  Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)

  A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an au…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9.4 Extended Update Support Linux Debian Ubuntu Azure Linux Alpine
  Oct 15, 2024
• Medium 5.4
  CVE-2024-9341

  Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

  A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the sy…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat OpenShift Container Platform 4.14 Linux Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 1, 2024
• Medium 4.7
  CVE-2024-9407

  Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction

  A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exp…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 1, 2024
• Medium 4.3
  CVE-2024-34155

  Stack exhaustion in all Parse functions in go/parser

  Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

  Go standard library go/parser katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2310527
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2310528
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2310529
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315691
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315887
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2317458
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2317467
• article
  https://issues.redhat.com/browse/RHEL-62107
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9459.json
• report
  https://access.redhat.com/security/cve/CVE-2024-9341
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9341
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9341
• article
  https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L169
• article
  https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L349
• report
  https://access.redhat.com/security/cve/CVE-2024-9407
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9407
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9407
• advisory
  https://github.com/advisories/GHSA-fhqq-8f65-5xfc
• report
  https://access.redhat.com/security/cve/CVE-2024-9675
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9675
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9675
• report
  https://access.redhat.com/security/cve/CVE-2024-9676
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9676
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9676
• advisory
  https://github.com/advisories/GHSA-wq2p-5pc6-wpgf
• article
  https://github.com/containers/storage/commit/935c58f4b3e364a9c9d33ed06476a831e6ad5679
• report
  https://access.redhat.com/security/cve/CVE-2024-34155
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-34155
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-34155
• article
  https://go.dev/cl/611238
• article
  https://go.dev/issue/69138
• article
  https://groups.google.com/g/golang-dev/c/S9POB9NCTdk
• advisory
  https://pkg.go.dev/vuln/GO-2024-3105
• report
  https://access.redhat.com/security/cve/CVE-2024-34156
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-34156
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-34156
• article
  https://go.dev/cl/611239
• article
  https://go.dev/issue/69139