CVE-2024-9675

MEDIUM

MEDIUM Priority: 0.02 BB Relevance: 34/100

Published: 2024-10-09 Modified: 2026-10-30 First seen: 2026-10-30 Status: active

Attack Surface

Low Complexity No Interaction

CVSS Vector Breakdown

AV: Local

AC: Low

PR: Low

UI: None

S: Unchanged

C: Low

I: Low

A: None

Description

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

Weakness Classification (1)

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Software (46)

Vendor	Product	Version
—	—	0 < 1.38.0
buildah_project	buildah	-
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux_eus	8.8
redhat	enterprise_linux_eus	9.0
redhat	enterprise_linux_eus	9.2
redhat	enterprise_linux_eus	9.4
redhat	enterprise_linux_for_arm_64	8.0_aarch64
redhat	enterprise_linux_for_arm_64	9.0_aarch64
redhat	enterprise_linux_for_arm_64_eus	8.8_aarch64
redhat	enterprise_linux_for_arm_64_eus	9.0_aarch64
redhat	enterprise_linux_for_arm_64_eus	9.2_aarch64
redhat	enterprise_linux_for_arm_64_eus	9.4_aarch64
redhat	enterprise_linux_for_ibm_z_systems	8.0_s390x
redhat	enterprise_linux_for_ibm_z_systems	9.0_s390x
redhat	enterprise_linux_for_ibm_z_systems_eus	8.8_s390x
redhat	enterprise_linux_for_ibm_z_systems_eus	9.0_s390x
redhat	enterprise_linux_for_ibm_z_systems_eus	9.2_s390x
redhat	enterprise_linux_for_ibm_z_systems_eus	9.4_s390x
redhat	enterprise_linux_for_power_little_endian	8.0_ppc64le
redhat	enterprise_linux_for_power_little_endian	9.0_ppc64le
redhat	enterprise_linux_for_power_little_endian_eus	8.8_ppc64le
redhat	enterprise_linux_for_power_little_endian_eus	9.0_ppc64le
redhat	enterprise_linux_for_power_little_endian_eus	9.2_ppc64le
redhat	enterprise_linux_for_power_little_endian_eus	9.4_ppc64le
redhat	enterprise_linux_server_aus	8.6
redhat	enterprise_linux_server_aus	9.2
redhat	enterprise_linux_server_aus	9.4
redhat	enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions	8.6_ppc64le

Showing 30 of 46 entries