CVE catalog

CVE-2024-9675

golang-github-containers-buildah: CVE-2024-9675

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.39% · Oct 25, 2026

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-containers-buildahsid1.43.2+ds1-3fixed
Debiangolang-github-containers-buildahforky1.43.2+ds1-3fixed
Debiangolang-github-containers-buildahtrixie1.39.3+ds1-1fixed
Debiangolang-github-containers-buildahbookworm1.28.2+ds1-3+deb12u1vulnerable
Ubuntugolang-github-containers-buildah22.041.21.3+ds1-1ubuntu1vulnerable
Ubuntugolang-github-containers-buildah22.041.23.1+ds1-2vulnerable
Ubuntugolang-github-containers-buildahpro1.28.2+ds1-3build1vulnerable
Ubuntugolang-github-containers-buildahpro1.32.2+ds1-1vulnerable
Ubuntugolang-github-containers-buildahpro1.33.1+ds1-2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.3+ds1-2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.5+ds1-4vulnerable
Ubuntugolang-github-containers-buildahpro1.33.5+ds1-4build1vulnerable
Ubuntugolang-github-containers-buildahpro1.33.5+ds1-4build2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.1vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.2+esm1vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.2+esm2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.3vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.3+esm2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.3+esm3vulnerable
Opensusepodmantumbleweed5.2.4-2.1fixed
Opensusebuildahtumbleweed1.37.4-2.1fixed
Susebuildahlinux enterprise module for containers 15 sp51.35.4-150500.3.16.1fixed
Susebuildahlinux enterprise module for containers 15 sp61.35.4-150500.3.16.1fixed
Opensusebuildahleap 15.51.35.4-150500.3.16.1fixed
Opensusebuildahleap 15.61.35.4-150500.3.16.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-containers-buildahsourcesid1.37.4+ds1-1not yet assignedNot reported[1084980]
Debiangolang-github-containers-buildahsourceforky1.37.4+ds1-1not yet assignedNot reported[1084980]
Debiangolang-github-containers-buildahsourcetrixie1.37.4+ds1-1not yet assignedNot reported[1084980]
Debiangolang-github-containers-buildahsourcebookworm(unfixed)not yet assignedNot reported[1084980]
Opensusepodmanrpmtumbleweed5.2.4-2.1Not reportedOPENSUSE-SU-2024:14409-1Not reported
Opensusebuildahrpmtumbleweed1.37.4-2.1Not reportedOPENSUSE-SU-2024:14405-1Not reported
Susebuildahrpmlinux enterprise module for containers 15 sp51.35.4-150500.3.16.1Not reportedSUSE-SU-2024:3728-1Not reported
Susebuildahrpmlinux enterprise module for containers 15 sp61.35.4-150500.3.16.1Not reportedSUSE-SU-2024:3728-1Not reported
Opensusebuildahrpmleap 15.51.35.4-150500.3.16.1Not reportedSUSE-SU-2024:3728-1Not reported
Opensusebuildahrpmleap 15.61.35.4-150500.3.16.1Not reportedSUSE-SU-2024:3728-1Not reported

[Debian bug #1084980]

Notes

[bookworm] golang-github-containers-buildah: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [buildah]Affected

    Source package: [golang-github-containers-buildah]

    Details (2)

    • 1.28.2+ds1-3+deb12u1+b3 · amd64 · bookworm

      Affected

      dsa · golang-github-containers-buildah · debian · bookworm; dsa · golang-github-containers-buildah · debian · 12

    • 1.28.2+ds1-3+deb12u1+b3 · arm64 · bookworm

      Affected

      dsa · golang-github-containers-buildah · debian · bookworm; dsa · golang-github-containers-buildah · debian · 12

  • [golang-github-containers-buildah-dev]Affected

    Source package: [golang-github-containers-buildah]

    Details (2)

    • 1.28.2+ds1-3+deb12u1 · all · bookworm

      Affected

      dsa · golang-github-containers-buildah · debian · bookworm; dsa · golang-github-containers-buildah · debian · 12

    • 1.28.2+ds1-3+deb12u1 · all · bookworm

      Affected

      dsa · golang-github-containers-buildah · debian · bookworm; dsa · golang-github-containers-buildah · debian · 12

[openSUSE Tumbleweed]

  • [podman-docker]Unknown

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 5.2.4-2.1

      Version impact unknown

      dsa · podman · opensuse · tumbleweed

  • [podman-remote]Unknown

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.2.4-2.1

      Version impact unknown

      dsa · podman · opensuse · tumbleweed

  • [podmansh]Unknown

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.2.4-2.1

      Version impact unknown

      dsa · podman · opensuse · tumbleweed

  • [buildah]Fixed

    Source package: [buildah]

    Details (1)

    • 1.44.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.37.4-2.1

      dsa · buildah · opensuse · tumbleweed

  • [podman]Fixed

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 5.2.4-2.1

      dsa · podman · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [buildah]Fixed

    Source package: [golang-github-containers-buildah]

    Details (2)

    • 1.39.3+ds1-1+b7 · amd64 · trixie

      Fixed · Fixed: 1.37.4+ds1-1

      dsa · golang-github-containers-buildah · debian · 13

    • 1.39.3+ds1-1+b7 · arm64 · trixie

      Fixed · Fixed: 1.37.4+ds1-1

      dsa · golang-github-containers-buildah · debian · 13

  • [golang-github-containers-buildah-dev]Fixed

    Source package: [golang-github-containers-buildah]

    Details (2)

    • 1.39.3+ds1-1 · all · trixie

      Fixed · Fixed: 1.37.4+ds1-1

      dsa · golang-github-containers-buildah · debian · 13

    • 1.39.3+ds1-1 · all · trixie

      Fixed · Fixed: 1.37.4+ds1-1

      dsa · golang-github-containers-buildah · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]