Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/containers/common
  4. ›
  5. CVE-2024-9341

CVE-2024-9341: Link Following in github.com/containers/common

October 1, 2024 (updated December 11, 2024)

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.

References

  • access.redhat.com/errata/RHSA-2024:10147
  • access.redhat.com/errata/RHSA-2024:10818
  • access.redhat.com/errata/RHSA-2024:7925
  • access.redhat.com/errata/RHSA-2024:8039
  • access.redhat.com/errata/RHSA-2024:8112
  • access.redhat.com/errata/RHSA-2024:8238
  • access.redhat.com/errata/RHSA-2024:8263
  • access.redhat.com/errata/RHSA-2024:8428
  • access.redhat.com/errata/RHSA-2024:8690
  • access.redhat.com/errata/RHSA-2024:8694
  • access.redhat.com/errata/RHSA-2024:8846
  • access.redhat.com/errata/RHSA-2024:9454
  • access.redhat.com/errata/RHSA-2024:9459
  • access.redhat.com/security/cve/CVE-2024-9341
  • bugzilla.redhat.com/show_bug.cgi?id=2315691
  • github.com/advisories/GHSA-mc76-5925-c5p6
  • github.com/containers/common
  • github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go
  • github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go
  • github.com/containers/common/commit/e7db06585c32e1a782c1d9aa3b71ccd708f5e23f
  • nvd.nist.gov/vuln/detail/CVE-2024-9341

Code Behaviors & Features

Detect and mitigate CVE-2024-9341 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.60.4

Fixed versions

  • 0.60.4

Solution

Upgrade to version 0.60.4 or above.

Impact 5.4 MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

Learn more about CVSS

Weakness

  • CWE-59: Improper Link Resolution Before File Access ('Link Following')

Source file

go/github.com/containers/common/CVE-2024-9341.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:23 +0000.