CVE-2024-9341
EUVD-2024-307901.10.2024, 19:15
A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| containers | common | * |
| redhat | openshift_container_platform | 4.12 |
| redhat | openshift_container_platform | 4.13 |
| redhat | openshift_container_platform | 4.14 |
| redhat | openshift_container_platform | 4.15 |
| redhat | openshift_container_platform | 4.16 |
| redhat | openshift_container_platform | 4.17 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References