CVE-2024-3727 – github.com/containers/image/v5

Package

Manager: go
Name: github.com/containers/image/v5
Vulnerable Version: >=5.30.0 <5.30.1 || >=0 <5.29.3

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

EPSS: 0.00371 pctl0.58086

Details

github.com/containers/image allows unexpected authenticated registry accesses A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

Metadata

Created: 2024-05-14T18:30:52Z
Modified: 2025-02-25T18:39:25Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-6wvf-f2vw-3425/GHSA-6wvf-f2vw-3425.json
CWE IDs: ["CWE-354"]
Alternative ID: GHSA-6wvf-f2vw-3425
Finding: F086
Auto approve: 1