CVE catalog

CVE-2024-9407

golang-github-containers-buildah: CVE-2024-9407

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.29% · Oct 25, 2026

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-containers-buildahsid1.43.2+ds1-3fixed
Debiangolang-github-containers-buildahforky1.43.2+ds1-3fixed
Debiangolang-github-containers-buildahtrixie1.39.3+ds1-1fixed
Debiangolang-github-containers-buildahbookworm1.28.2+ds1-3+deb12u1vulnerable
Ubuntugolang-github-containers-buildah22.041.21.3+ds1-1ubuntu1vulnerable
Ubuntugolang-github-containers-buildah22.041.23.1+ds1-2vulnerable
Ubuntugolang-github-containers-buildahpro1.28.2+ds1-3build1vulnerable
Ubuntugolang-github-containers-buildahpro1.32.2+ds1-1vulnerable
Ubuntugolang-github-containers-buildahpro1.33.1+ds1-2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.3+ds1-2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.5+ds1-4vulnerable
Ubuntugolang-github-containers-buildahpro1.33.5+ds1-4build1vulnerable
Ubuntugolang-github-containers-buildahpro1.33.5+ds1-4build2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.1vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.2+esm1vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.2+esm2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.3vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.3+esm2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.3+esm3vulnerable
Susepodmanlinux enterprise micro 5.54.9.5-150500.3.25.1fixed
Susepodmanlinux enterprise module for containers 15 sp54.9.5-150500.3.25.1fixed
Susepodmanlinux enterprise module for containers 15 sp64.9.5-150500.3.25.1fixed
Opensusepodmanleap micro 5.54.9.5-150500.3.25.1fixed
Opensusepodmanleap 15.54.9.5-150500.3.25.1fixed
Opensusepodmanleap 15.64.9.5-150500.3.25.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-containers-buildahsourcesid1.37.4+ds1-1not yet assignedNot reported[1084980]
Debiangolang-github-containers-buildahsourceforky1.37.4+ds1-1not yet assignedNot reported[1084980]
Debiangolang-github-containers-buildahsourcetrixie1.37.4+ds1-1not yet assignedNot reported[1084980]
Debiangolang-github-containers-buildahsourcebookworm(unfixed)not yet assignedNot reported[1084980]
Susepodmanrpmlinux enterprise micro 5.54.9.5-150500.3.25.1Not reportedSUSE-SU-2024:3741-1Not reported
Susepodmanrpmlinux enterprise module for containers 15 sp54.9.5-150500.3.25.1Not reportedSUSE-SU-2024:3741-1Not reported
Susepodmanrpmlinux enterprise module for containers 15 sp64.9.5-150500.3.25.1Not reportedSUSE-SU-2024:3741-1Not reported
Opensusepodmanrpmleap micro 5.54.9.5-150500.3.25.1Not reportedSUSE-SU-2024:3741-1Not reported
Opensusepodmanrpmleap 15.54.9.5-150500.3.25.1Not reportedSUSE-SU-2024:3741-1Not reported
Opensusepodmanrpmleap 15.64.9.5-150500.3.25.1Not reportedSUSE-SU-2024:3741-1Not reported

[Debian bug #1084980]

Notes

[bookworm] golang-github-containers-buildah: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [buildah]Affected

    Source package: [golang-github-containers-buildah]

    Details (2)

    • 1.28.2+ds1-3+deb12u1+b3 · amd64 · bookworm

      Affected

      dsa · golang-github-containers-buildah · debian · bookworm; dsa · golang-github-containers-buildah · debian · 12

    • 1.28.2+ds1-3+deb12u1+b3 · arm64 · bookworm

      Affected

      dsa · golang-github-containers-buildah · debian · bookworm; dsa · golang-github-containers-buildah · debian · 12

  • [golang-github-containers-buildah-dev]Affected

    Source package: [golang-github-containers-buildah]

    Details (2)

    • 1.28.2+ds1-3+deb12u1 · all · bookworm

      Affected

      dsa · golang-github-containers-buildah · debian · bookworm; dsa · golang-github-containers-buildah · debian · 12

    • 1.28.2+ds1-3+deb12u1 · all · bookworm

      Affected

      dsa · golang-github-containers-buildah · debian · bookworm; dsa · golang-github-containers-buildah · debian · 12

[Debian 13 (Trixie)]

  • [buildah]Fixed

    Source package: [golang-github-containers-buildah]

    Details (2)

    • 1.39.3+ds1-1+b7 · amd64 · trixie

      Fixed · Fixed: 1.37.4+ds1-1

      dsa · golang-github-containers-buildah · debian · 13

    • 1.39.3+ds1-1+b7 · arm64 · trixie

      Fixed · Fixed: 1.37.4+ds1-1

      dsa · golang-github-containers-buildah · debian · 13

  • [golang-github-containers-buildah-dev]Fixed

    Source package: [golang-github-containers-buildah]

    Details (2)

    • 1.39.3+ds1-1 · all · trixie

      Fixed · Fixed: 1.37.4+ds1-1

      dsa · golang-github-containers-buildah · debian · 13

    • 1.39.3+ds1-1 · all · trixie

      Fixed · Fixed: 1.37.4+ds1-1

      dsa · golang-github-containers-buildah · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]