CVE-2024-3727highCWE-354

CVE-2024-3727: falha de alta gravidade em image

Containers/image: digest type does not guarantee valid type

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat Enterprise Linux+ Monitorar Red Hat OpenShift Container Platform

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.3epss 1.3%
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
imageRed Hat · Multicluster Engine for KubernetesRed Hat · OADP-1.3-RHEL-9Red Hat · OpenShift Developer Tools and ServicesRed Hat · OpenShift ServerlessRed Hat · OpenShift Source-to-Image (S2I)Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2Red Hat · Red Hat Advanced Cluster Security 3Red Hat · Red Hat Advanced Cluster Security 4.4Red Hat · Red Hat Advanced Cluster Security 4.5Red Hat · Red Hat Ansible Automation Platform 1.2Red Hat · Red Hat Ansible Automation Platform 2Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 7Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Migration Toolkit for Containers 1.8Red Hat · Red Hat OpenShift Container Platform 3.11Red Hat · Red Hat OpenShift Container Platform 4Red Hat · Red Hat OpenShift Container Platform 4.13Red Hat · Red Hat OpenShift Container Platform 4.14Red Hat · Red Hat OpenShift Container Platform 4.15Red Hat · Red Hat OpenShift Container Platform 4.16Red Hat · Red Hat OpenShift Container Platform 4.17Red Hat · Red Hat OpenShift Container Platform 4.18Red Hat · Red Hat OpenShift Container Platform Assisted Installer 1Red Hat · Red Hat OpenShift Dev SpacesRed Hat · Red Hat Openshift Sandboxed ContainersRed Hat · Red Hat OpenShift Virtualization 4Red Hat · Red Hat OpenStack Platform 16.2Red Hat · Red Hat Quay 3Red Hat · RHEL-9-CNV-4.15
CVEs relacionadas — image

No mesmo produto, das mais perigosas para as menos.

CVE-2026-16242CRITICALHypershift: konnectivity proxy-server accepts agent connections without validating client certificatesEPSS 0.9%CVE-2024-12401MEDIUMCert-manager: potential dos when parsing specially crafted pem inputsEPSS 0.7%CVE-2025-2241HIGHHive: exposure of vcenter credentials via clusterprovision in hive / mce / acmEPSS 0.5%CVE-2026-101919HIGHHypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control planeEPSS 0.4%CVE-2026-71299MEDIUMMaestro: maestro: rest api write endpoints registered without authentication middlewareEPSS 0.3%CVE-2026-71298MEDIUMMaestro: sql identifier injection via properties.* search filter and orderby fieldEPSS 0.3%