CVE catalog
CVE-2024-3727
golang-github-containers-image: CVE-2024-3727
- Severity
- High · CVSS 8.3
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.28% · Oct 25, 2026
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | golang-github-containers-image | sid | 5.39.2-3 | fixed |
| Debian | golang-github-containers-image | forky | 5.39.2-3 | fixed |
| Debian | golang-github-containers-image | trixie | 5.34.2-1 | fixed |
| Debian | golang-github-containers-image | bookworm | 5.23.1-4 | vulnerable |
| Opensuse | containerized-data-importer1.65 | tumbleweed | 1.65.0-1.1 | fixed |
| Opensuse | containerized-data-importer-1.65 | tumbleweed | 1.65.0-1.1 | fixed |
| Suse | containerized-data-importer | linux micro 6.0 | 1.60.1-1.1 | fixed |
| Suse | govulncheck-vulndb | linux enterprise module for package hub 15 sp6 | 0.0.20250207T224745-150000.1.32.1 | fixed |
| Opensuse | govulncheck-vulndb | leap 15.6 | 0.0.20250207T224745-150000.1.32.1 | fixed |
| Suse | containerized-data-importer | linux enterprise micro 5.5 | 1.58.0-150500.6.15.1 | fixed |
| Suse | containerized-data-importer | linux enterprise module for containers 15 sp5 | 1.58.0-150500.6.15.1 | fixed |
| Opensuse | containerized-data-importer | leap 15.5 | 1.58.0-150500.6.15.1 | fixed |
| Suse | containerized-data-importer | linux enterprise module for containers 15 sp6 | 1.58.0-150600.3.3.2 | fixed |
| Opensuse | containerized-data-importer | leap 15.6 | 1.58.0-150600.3.3.2 | fixed |
| Opensuse | apptainer | tumbleweed | 1.3.0-2.1 | fixed |
| Opensuse | skopeo | tumbleweed | 1.15.1-1.1 | fixed |
| Suse | skopeo | linux enterprise high performance computing 15 sp2-ltss | 0.1.41-150000.4.23.1 | fixed |
| Suse | skopeo | linux enterprise server 15 sp2-ltss | 0.1.41-150000.4.23.1 | fixed |
| Suse | skopeo | linux enterprise server for sap applications 15 sp2 | 0.1.41-150000.4.23.1 | fixed |
| Opensuse | govulncheck-vulndb | tumbleweed | 0.0.20250130T185858-1.1 | fixed |
| Suse | warewulf4 | linux enterprise module for hpc 15 sp5 | 4.5.2-150500.6.13.1 | fixed |
| Suse | warewulf4 | linux enterprise module for hpc 15 sp6 | 4.5.2-150500.6.13.1 | fixed |
| Opensuse | warewulf4 | leap 15.5 | 4.5.2-150500.6.13.1 | fixed |
| Opensuse | warewulf4 | leap 15.6 | 4.5.2-150500.6.13.1 | fixed |
| Opensuse | podman | tumbleweed | 5.0.3-1.1 | fixed |
| Suse | podman | linux enterprise high performance computing 15 sp2-ltss | 2.1.1-150100.4.31.1 | fixed |
| Suse | podman | linux enterprise server 15 sp2-ltss | 2.1.1-150100.4.31.1 | fixed |
| Suse | podman | linux enterprise server for sap applications 15 sp2 | 2.1.1-150100.4.31.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | golang-github-containers-image | source | sid | 5.29.3-1 | not yet assigned | Not reported | [1070858] |
| Debian | golang-github-containers-image | source | forky | 5.29.3-1 | not yet assigned | Not reported | [1070858] |
| Debian | golang-github-containers-image | source | trixie | 5.29.3-1 | not yet assigned | Not reported | [1070858] |
| Debian | golang-github-containers-image | source | bookworm | (unfixed) | not yet assigned | Not reported | [1070858] |
| Opensuse | containerized-data-importer1.65 | rpm | tumbleweed | 1.65.0-1.1 | Not reported | OPENSUSE-SU-2026:11074-1 | Not reported |
| Opensuse | containerized-data-importer-1.65 | rpm | tumbleweed | 1.65.0-1.1 | Not reported | OPENSUSE-SU-2026:11054-1 | Not reported |
| Suse | containerized-data-importer | rpm | linux micro 6.0 | 1.60.1-1.1 | Not reported | SUSE-SU-2025:20055-1 | Not reported |
| Suse | govulncheck-vulndb | rpm | linux enterprise module for package hub 15 sp6 | 0.0.20250207T224745-150000.1.32.1 | Not reported | SUSE-SU-2025:0429-1 | Not reported |
| Opensuse | govulncheck-vulndb | rpm | leap 15.6 | 0.0.20250207T224745-150000.1.32.1 | Not reported | SUSE-SU-2025:0429-1 | Not reported |
| Suse | containerized-data-importer | rpm | linux enterprise micro 5.5 | 1.58.0-150500.6.15.1 | Not reported | SUSE-SU-2024:1988-1 | Not reported |
| Suse | containerized-data-importer | rpm | linux enterprise module for containers 15 sp5 | 1.58.0-150500.6.15.1 | Not reported | SUSE-SU-2024:1988-1 | Not reported |
| Opensuse | containerized-data-importer | rpm | leap 15.5 | 1.58.0-150500.6.15.1 | Not reported | SUSE-SU-2024:1988-1 | Not reported |
| Suse | containerized-data-importer | rpm | linux enterprise module for containers 15 sp6 | 1.58.0-150600.3.3.2 | Not reported | SUSE-SU-2024:1989-1 | Not reported |
| Opensuse | containerized-data-importer | rpm | leap 15.6 | 1.58.0-150600.3.3.2 | Not reported | SUSE-SU-2024:1989-1 | Not reported |
| Opensuse | apptainer | rpm | tumbleweed | 1.3.0-2.1 | Not reported | OPENSUSE-SU-2024:13951-1 | Not reported |
| Opensuse | skopeo | rpm | tumbleweed | 1.15.1-1.1 | Not reported | OPENSUSE-SU-2024:14019-1 | Not reported |
| Suse | skopeo | rpm | linux enterprise high performance computing 15 sp2-ltss | 0.1.41-150000.4.23.1 | Not reported | SUSE-SU-2024:2383-1 | Not reported |
| Suse | skopeo | rpm | linux enterprise server 15 sp2-ltss | 0.1.41-150000.4.23.1 | Not reported | SUSE-SU-2024:2383-1 | Not reported |
| Suse | skopeo | rpm | linux enterprise server for sap applications 15 sp2 | 0.1.41-150000.4.23.1 | Not reported | SUSE-SU-2024:2383-1 | Not reported |
| Opensuse | govulncheck-vulndb | rpm | tumbleweed | 0.0.20250130T185858-1.1 | Not reported | OPENSUSE-SU-2025:14728-1 | Not reported |
| Suse | warewulf4 | rpm | linux enterprise module for hpc 15 sp5 | 4.5.2-150500.6.13.1 | Not reported | SUSE-SU-2024:1838-1 | Not reported |
| Suse | warewulf4 | rpm | linux enterprise module for hpc 15 sp6 | 4.5.2-150500.6.13.1 | Not reported | SUSE-SU-2024:1838-1 | Not reported |
| Opensuse | warewulf4 | rpm | leap 15.5 | 4.5.2-150500.6.13.1 | Not reported | SUSE-SU-2024:1838-1 | Not reported |
| Opensuse | warewulf4 | rpm | leap 15.6 | 4.5.2-150500.6.13.1 | Not reported | SUSE-SU-2024:1838-1 | Not reported |
| Opensuse | podman | rpm | tumbleweed | 5.0.3-1.1 | Not reported | OPENSUSE-SU-2024:13960-1 | Not reported |
| Suse | podman | rpm | linux enterprise high performance computing 15 sp2-ltss | 2.1.1-150100.4.31.1 | Not reported | SUSE-SU-2024:2548-1 | Not reported |
| Suse | podman | rpm | linux enterprise server 15 sp2-ltss | 2.1.1-150100.4.31.1 | Not reported | SUSE-SU-2024:2548-1 | Not reported |
| Suse | podman | rpm | linux enterprise server for sap applications 15 sp2 | 2.1.1-150100.4.31.1 | Not reported | SUSE-SU-2024:2548-1 | Not reported |
Notes
[bookworm] golang-github-containers-image: Minor issue
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2024_5258.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2024-3727]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-3727]
- [https://osv.dev/vulnerability/SUSE-SU-2024:1838-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:1988-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:1989-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:2383-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:2548-1]
- [https://osv.dev/vulnerability/SUSE-SU-2025:0429-1]
- [https://osv.dev/vulnerability/SUSE-SU-2025:20055-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13951-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13960-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:14019-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14728-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11054-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11074-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-3727]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-3727.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1474.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]