CVE catalog

CVE-2019-10214

golang-github-containers-image affected and fixed versions

[CVE catalog]

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.

Severity
Critical · CVSS 9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.59% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Opensusetumbleweedbuildah1.23.0-1.1UnknownSource applicability is not established[OPENSUSE-SU-2024:10666-1]
Debiantrixiegolang-github-containers-imageNot reportedNot affectedDistribution reports not affected[CVE-2019-10214]
Debiantrixiegolang-github-containers-image5.34.2-1Not affected[CVE-2019-10214]
Debiansidgolang-github-containers-imageNot reportedNot affectedDistribution reports not affected[CVE-2019-10214]
Debiansidgolang-github-containers-image5.39.2-3Not affected[CVE-2019-10214]
Suselinux enterprise module for server applications 15 sp1skopeo0.1.32-4.8.1UnknownSource applicability is not established[SUSE-SU-2019:2340-1]
Suselinux enterprise module for server applications 15 sp1skopeo0.1.41-4.11.1UnknownSource applicability is not established[SUSE-SU-2020:0712-1]
Suselinux enterprise module for server applications 15skopeo0.1.32-4.8.1UnknownSource applicability is not established[SUSE-SU-2019:2340-1]
Suselinux enterprise module for containers 15 sp3buildah1.23.1-150300.8.3.1UnknownSource applicability is not established[SUSE-SU-2022:0770-1]
Suselinux enterprise module for containers 15 sp2buildah1.17.0-3.6.1UnknownSource applicability is not established[SUSE-SU-2020:3423-1]
Suselinux enterprise module for containers 15 sp1buildah1.17.0-3.6.1UnknownSource applicability is not established[SUSE-SU-2020:3423-1]
Suselinux enterprise module for containers 15 sp1buildah1.7.1-3.3.1UnknownSource applicability is not established[SUSE-SU-2019:2341-1]

Showing 12 observations. All 27 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormgolang-github-containers-imageNot reportedNot affectedDistribution reports not affected[CVE-2019-10214]
Debianbookwormgolang-github-containers-image5.23.1-4Not affected[CVE-2019-10214]
Debianforkygolang-github-containers-imageNot reportedNot affectedDistribution reports not affected[CVE-2019-10214]
Debianforkygolang-github-containers-image5.39.2-3Not affected[CVE-2019-10214]
Debiansidgolang-github-containers-imageNot reportedNot affectedDistribution reports not affected[CVE-2019-10214]
Debiansidgolang-github-containers-image5.39.2-3Not affected[CVE-2019-10214]
Debiantrixiegolang-github-containers-imageNot reportedNot affectedDistribution reports not affected[CVE-2019-10214]
Debiantrixiegolang-github-containers-image5.34.2-1Not affected[CVE-2019-10214]
Opensuseleap 15.0skopeo0.1.32-lp150.8.1UnknownSource applicability is not established[OPENSUSE-SU-2019:2159-1]
Opensuseleap 15.1buildah1.17.0-lp151.2.6.1UnknownSource applicability is not established[OPENSUSE-SU-2020:2106-1]
Opensuseleap 15.1buildah1.7.1-lp151.2.3.1UnknownSource applicability is not established[OPENSUSE-SU-2019:2137-1]
Opensuseleap 15.1podman1.4.4-lp151.3.6.1UnknownSource applicability is not established[OPENSUSE-SU-2019:2143-1]
Opensuseleap 15.1skopeo0.1.32-lp151.2.3.1UnknownSource applicability is not established[OPENSUSE-SU-2019:2138-1]
Opensuseleap 15.1skopeo0.1.41-lp151.2.6.1UnknownSource applicability is not established[OPENSUSE-SU-2020:0377-1]
Opensuseleap 15.2buildah1.19.2-lp152.2.3.1UnknownSource applicability is not established[OPENSUSE-SU-2021:0310-1]
Opensuseleap 15.2libcontainers-common20210112-lp152.2.6.1UnknownSource applicability is not established[OPENSUSE-SU-2021:0310-1]
Opensuseleap 15.2podman2.2.1-lp152.4.9.1UnknownSource applicability is not established[OPENSUSE-SU-2021:0310-1]
Opensuseleap 15.3buildah1.23.1-150300.8.3.1UnknownSource applicability is not established[OPENSUSE-SU-2022:0770-1]
Opensusetumbleweedbuildah1.23.0-1.1UnknownSource applicability is not established[OPENSUSE-SU-2024:10666-1]
Suselinux enterprise module for containers 15 sp1buildah1.17.0-3.6.1UnknownSource applicability is not established[SUSE-SU-2020:3423-1]
Suselinux enterprise module for containers 15 sp1buildah1.7.1-3.3.1UnknownSource applicability is not established[SUSE-SU-2019:2341-1]
Suselinux enterprise module for containers 15 sp1podman1.4.4-4.11.1UnknownSource applicability is not established[SUSE-SU-2019:2346-1]
Suselinux enterprise module for containers 15 sp2buildah1.17.0-3.6.1UnknownSource applicability is not established[SUSE-SU-2020:3423-1]
Suselinux enterprise module for containers 15 sp3buildah1.23.1-150300.8.3.1UnknownSource applicability is not established[SUSE-SU-2022:0770-1]
Suselinux enterprise module for server applications 15skopeo0.1.32-4.8.1UnknownSource applicability is not established[SUSE-SU-2019:2340-1]
Suselinux enterprise module for server applications 15 sp1skopeo0.1.32-4.8.1UnknownSource applicability is not established[SUSE-SU-2019:2340-1]
Suselinux enterprise module for server applications 15 sp1skopeo0.1.41-4.11.1UnknownSource applicability is not established[SUSE-SU-2020:0712-1]
Original provider fields
{
  "package_releases": [
    {
      "name": "golang-github-containers-image",
      "status": "not affected",
      "release": "sid",
      "version": "5.39.2-3"
    },
    {
      "name": "golang-github-containers-image",
      "status": "not affected",
      "release": "forky",
      "version": "5.39.2-3"
    },
    {
      "name": "golang-github-containers-image",
      "status": "not affected",
      "release": "trixie",
      "version": "5.34.2-1"
    },
    {
      "name": "golang-github-containers-image",
      "status": "not affected",
      "release": "bookworm",
      "version": "5.23.1-4"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "golang-github-containers-image",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "golang-github-containers-image",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "golang-github-containers-image",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "golang-github-containers-image",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": [
    {
      "name": "skopeo",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.32-lp150.8.1"
            }
          ]
        }
      ],
      "release": "leap 15.0",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2019:2159-1",
      "fixed_version": "0.1.32-lp150.8.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2019:2159-1",
      "provider_updated_at": "2026-02-04T04:18:06.843744Z",
      "applicability_unknown": true
    },
    {
      "name": "skopeo",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.32-4.8.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for server applications 15",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2340-1",
      "fixed_version": "0.1.32-4.8.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2340-1",
      "provider_updated_at": "2026-02-04T04:13:44.327325Z",
      "applicability_unknown": true
    },
    {
      "name": "skopeo",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.32-4.8.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for server applications 15 sp1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2340-1",
      "fixed_version": "0.1.32-4.8.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2340-1",
      "provider_updated_at": "2026-02-04T04:13:44.327325Z",
      "applicability_unknown": true
    },
    {
      "name": "buildah",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.17.0-lp151.2.6.1"
            }
          ]
        }
      ],
      "release": "leap 15.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2020:2106-1",
      "fixed_version": "1.17.0-lp151.2.6.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2020:2106-1",
      "provider_updated_at": "2026-02-04T04:04:49.802167Z",
      "applicability_unknown": true
    },
    {
      "name": "buildah",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.17.0-3.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for containers 15 sp1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2020:3423-1",
      "fixed_version": "1.17.0-3.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2020:3423-1",
      "provider_updated_at": "2026-02-04T03:56:02.237927Z",
      "applicability_unknown": true
    },
    {
      "name": "buildah",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.17.0-3.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for containers 15 sp2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2020:3423-1",
      "fixed_version": "1.17.0-3.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2020:3423-1",
      "provider_updated_at": "2026-02-04T03:56:02.237927Z",
      "applicability_unknown": true
    },
    {
      "name": "podman",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.4-4.11.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for containers 15 sp1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2346-1",
      "fixed_version": "1.4.4-4.11.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2346-1",
      "provider_updated_at": "2026-02-04T03:43:17.422170Z",
      "applicability_unknown": true
    },
    {
      "name": "buildah",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.19.2-lp152.2.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2021:0310-1",
      "fixed_version": "1.19.2-lp152.2.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2021:0310-1",
      "provider_updated_at": "2026-02-04T03:39:44.110025Z",
      "applicability_unknown": true
    },
    {
      "name": "libcontainers-common",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20210112-lp152.2.6.1"
            }
          ]
        }
      ],
      "release": "leap 15.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2021:0310-1",
      "fixed_version": "20210112-lp152.2.6.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2021:0310-1",
      "provider_updated_at": "2026-02-04T03:39:44.110025Z",
      "applicability_unknown": true
    },
    {
      "name": "podman",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.1-lp152.4.9.1"
            }
          ]
        }
      ],
      "release": "leap 15.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2021:0310-1",
      "fixed_version": "2.2.1-lp152.4.9.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2021:0310-1",
      "provider_updated_at": "2026-02-04T03:39:44.110025Z",
      "applicability_unknown": true
    },
    {
      "name": "buildah",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.1-3.3.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for containers 15 sp1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2341-1",
      "fixed_version": "1.7.1-3.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2341-1",
      "provider_updated_at": "2026-02-04T03:35:23.615350Z",
      "applicability_unknown": true
    },
    {
      "name": "podman",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.4-lp151.3.6.1"
            }
          ]
        }
      ],
      "release": "leap 15.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2019:2143-1",
      "fixed_version": "1.4.4-lp151.3.6.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2019:2143-1",
      "provider_updated_at": "2026-02-04T03:28:24.711090Z",
      "applicability_unknown": true
    },
    {
      "name": "buildah",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.23.0-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:10666-1",
      "fixed_version": "1.23.0-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:10666-1",
      "provider_updated_at": "2026-02-04T03:16:18.190894Z",
      "applicability_unknown": true
    },
    {
      "name": "buildah",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.23.1-150300.8.3.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for containers 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:0770-1",
      "fixed_version": "1.23.1-150300.8.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:0770-1",
      "provider_updated_at": "2026-02-04T03:15:43.934984Z",
      "applicability_unknown": true
    },
    {
      "name": "buildah",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.23.1-150300.8.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2022:0770-1",
      "fixed_version": "1.23.1-150300.8.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2022:0770-1",
      "provider_updated_at": "2026-02-04T03:03:39.107503Z",
      "applicability_unknown": true
    },
    {
      "name": "skopeo",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.32-lp151.2.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2019:2138-1",
      "fixed_version": "0.1.32-lp151.2.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2019:2138-1",
      "provider_updated_at": "2026-02-04T02:41:36.209146Z",
      "applicability_unknown": true
    },
    {
      "name": "skopeo",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.41-4.11.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for server applications 15 sp1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2020:0712-1",
      "fixed_version": "0.1.41-4.11.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2020:0712-1",
      "provider_updated_at": "2026-02-04T02:38:01.024864Z",
      "applicability_unknown": true
    },
    {
      "name": "skopeo",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.41-lp151.2.6.1"
            }
          ]
        }
      ],
      "release": "leap 15.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2020:0377-1",
      "fixed_version": "0.1.41-lp151.2.6.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2020:0377-1",
      "provider_updated_at": "2026-02-04T02:34:15.776105Z",
      "applicability_unknown": true
    },
    {
      "name": "buildah",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.1-lp151.2.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2019:2137-1",
      "fixed_version": "1.7.1-lp151.2.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2019:2137-1",
      "provider_updated_at": "2026-02-04T02:29:20.565822Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • Details (4)
    • 5.23.1-4 · all · bookworm

      Not affected

      dsa · golang-github-containers-image · debian · bookworm

    • 5.23.1-4 · all · bookworm

      Not affected

      dsa · golang-github-containers-image · debian · bookworm

    • 5.26.1-2~bpo12+1 · all · bookworm-backports

      Not affected

      dsa · golang-github-containers-image · debian · bookworm

    • 5.26.1-2~bpo12+1 · all · bookworm-backports

      Not affected

      dsa · golang-github-containers-image · debian · bookworm

  • Source package: [golang-github-containers-image]

    Details (4)
    • 5.23.1-4 · all · bookworm

      Not affected

      dsa · golang-github-containers-image · debian · bookworm

    • 5.23.1-4 · all · bookworm

      Not affected

      dsa · golang-github-containers-image · debian · bookworm

    • 5.26.1-2~bpo12+1 · all · bookworm-backports

      Not affected

      dsa · golang-github-containers-image · debian · bookworm

    • 5.26.1-2~bpo12+1 · all · bookworm-backports

      Not affected

      dsa · golang-github-containers-image · debian · bookworm

[openSUSE Tumbleweed]

  • [buildah]Unknown

    Source package: [buildah]

    Details (1)
    • 1.44.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.23.0-1.1

      dsa · buildah · opensuse · tumbleweed

Observed:

References