8.3

CVE-2024-3727: Containers/image: digest type does not guarantee valid type

Deferred
AliasesSUSE-SU-2024:1838-1SUSE-SU-2024:1988-1SUSE-SU-2024:1989-1
Published 09-05-2024Last modified 29-10-2026

Vulnerability summary

CVE-2024-3727 is a high (CVSS 8.3) vulnerability in buildah. EPSS estimates a 1.28% chance of exploitation in the next 30 days, higher than 70% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 8.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
8.3/10
010
High · v3.1 (CVE.org)
EPSS score
1.28%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 28 · Related 22
MGASA-2024-0343OPENSUSE-SU-2024:0244-1OPENSUSE-SU-2024:13952-1OPENSUSE-SU-2024:14059-1OPENSUSE-SU-2025:14728-1RHSA-2024:0045

Timeline

  1. 09-05-2024
    PublishedVulnerability first disclosed.
  2. 29-10-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

1.28%

Chance of exploitation in the next 30 days

Percentile

70%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.28% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Suse12 products
  • containerized-data-importer&distro=SUSE Linux Enterprise Micro 5.5< 1.58.0-150500.6.15.1
  • containerized-data-importer&distro=SUSE Linux Enterprise Module for Containers 15 SP5< 1.58.0-150500.6.15.1
  • containerized-data-importer&distro=SUSE Linux Enterprise Module for Containers 15 SP6< 1.58.0-150600.3.3.2
  • containerized-data-importer&distro=SUSE Linux Micro 6.0< 1.60.1-1.1
  • podman&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 2.1.1-150100.4.31.1
Opensuse9 products
  • apptainer&distro=openSUSE Tumbleweed< 1.3.0-2.1
  • containerized-data-importer-1.65&distro=openSUSE Tumbleweed< 1.65.0-1.1
  • containerized-data-importer1.65&distro=openSUSE Tumbleweed< 1.65.0-1.1
  • containerized-data-importer&distro=openSUSE Leap 15.5< 1.58.0-150500.6.15.1
  • containerized-data-importer&distro=openSUSE Leap 15.6< 1.58.0-150600.3.3.2
Alpine3 products
  • buildah< 1.35.4-r0
  • podman< 5.0.3-r0
  • skopeo< 1.15.1-r0
Chainguard3 products
  • buildah< 1.35.4-r0
  • skopeo< 1.15.1-r0
  • zot< 2.0.4-r2
Wolfi3 products
  • buildah< 1.35.4-r0
  • skopeo< 1.15.1-r0
  • zot< 2.0.4-r2
Debian1 product
  • golang-github-containers-imageAll versions (No fix recorded) | < 5.29.3-1
Github.com/containers1 product
  • image< 5.30.1
Github.com/containers/image1 product
  • v5< 5.29.3 | ≥ 5.30.0, < 5.30.1
Ubuntu1 product
  • golang-github-opencontainers-go-digestAll versions (No fix recorded)

9 vendors · 34 products

References

72 links
Show all 72 references