CVE catalog

CVE-2024-9676

golang-github-containers-storage: CVE-2024-9676

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.34% · Oct 25, 2026

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-containers-storagesid1.64.0-1fixed
Debiangolang-github-containers-storageforky1.64.0-1fixed
Debiangolang-github-containers-storagetrixie1.57.2+ds1-1fixed
Debiangolang-github-containers-storagebookworm1.43.0+ds1-8vulnerable
Ubuntugolang-github-containers-storage20.041.13.2+dfsg1-2vulnerable
Ubuntugolang-github-containers-storage20.041.13.2+dfsg1-3vulnerable
Ubuntugolang-github-containers-storage20.041.13.5+dfsg1-1vulnerable
Ubuntugolang-github-containers-storage20.041.15.1+dfsg1-1vulnerable
Ubuntugolang-github-containers-storage20.041.15.2+dfsg1-1vulnerable
Ubuntugolang-github-containers-storage20.041.15.3+dfsg1-1vulnerable
Ubuntugolang-github-containers-storage20.041.15.5+dfsg1-1vulnerable
Ubuntugolang-github-containers-storage20.041.15.7+dfsg1-1vulnerable
Ubuntugolang-github-containers-storage20.041.15.8+dfsg1-1vulnerable
Ubuntugolang-github-containers-storage20.041.15.8+dfsg1-1ubuntu1vulnerable
Ubuntugolang-github-containers-storage20.041.15.8+dfsg1-1ubuntu2vulnerable
Ubuntugolang-github-containers-storage20.041.15.8+dfsg1-1ubuntu2.1vulnerable
Ubuntugolang-github-containers-buildah22.041.21.3+ds1-1ubuntu1vulnerable
Ubuntugolang-github-containers-buildah22.041.23.1+ds1-2vulnerable
Ubuntugolang-github-containers-storagepro1.31.3+ds1-1ubuntu1vulnerable
Ubuntugolang-github-containers-storagepro1.36.0+ds1-2vulnerable
Ubuntugolang-github-containers-storagepro1.36.0+ds1-2ubuntu0.1vulnerable
Ubuntugolang-github-containers-storagepro1.36.0+ds1-2ubuntu0.1+esm1vulnerable
Ubuntugolang-github-containers-storagepro1.36.0+ds1-2ubuntu0.1+esm2vulnerable
Ubuntugolang-github-containers-storage24.041.43.0+ds1-8build1vulnerable
Ubuntugolang-github-containers-storage24.041.50.2+ds1-2vulnerable
Ubuntugolang-github-containers-storage24.041.51.0+ds1-2vulnerable
Ubuntugolang-github-containers-storage24.041.51.0+ds1-2ubuntu0.24.04.1vulnerable
Ubuntugolang-github-containers-storage24.041.51.0+ds1-2ubuntu0.24.04.2vulnerable
Ubuntugolang-github-containers-storage24.041.51.0+ds1-2ubuntu0.24.04.3vulnerable
Ubuntugolang-github-containers-buildahpro1.28.2+ds1-3build1vulnerable
Ubuntugolang-github-containers-buildahpro1.32.2+ds1-1vulnerable
Ubuntugolang-github-containers-buildahpro1.33.1+ds1-2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.3+ds1-2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.5+ds1-4vulnerable
Ubuntugolang-github-containers-buildahpro1.33.5+ds1-4build1vulnerable
Ubuntugolang-github-containers-buildahpro1.33.5+ds1-4build2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.1vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.2+esm1vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.2+esm2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.3vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.3+esm2vulnerable
Ubuntugolang-github-containers-buildahpro1.33.7+ds1-1ubuntu0.24.04.3+esm3vulnerable
Suseskopeolinux micro 6.01.14.4-2.1fixed
Susebuildahlinux enterprise module for containers 15 sp51.35.4-150500.3.19.1fixed
Susebuildahlinux enterprise module for containers 15 sp61.35.4-150500.3.19.1fixed
Opensusebuildahleap 15.51.35.4-150500.3.19.1fixed
Opensusebuildahleap 15.61.35.4-150500.3.19.1fixed
Opensusepodmantumbleweed5.2.4-3.1fixed
Susepodmanlinux enterprise micro 5.54.9.5-150500.3.28.1fixed
Susepodmanlinux enterprise module for containers 15 sp54.9.5-150500.3.28.1fixed
Susepodmanlinux enterprise module for containers 15 sp64.9.5-150500.3.28.1fixed
Opensusepodmanleap micro 5.54.9.5-150500.3.28.1fixed
Opensusepodmanleap 15.54.9.5-150500.3.28.1fixed
Opensusepodmanleap 15.64.9.5-150500.3.28.1fixed
Opensuseskopeotumbleweed1.16.1-2.1fixed
Opensusebuildahtumbleweed1.37.5-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-containers-storagesourcesid1.55.1+ds1-1not yet assignedNot reportedNot reported
Debiangolang-github-containers-storagesourceforky1.55.1+ds1-1not yet assignedNot reportedNot reported
Debiangolang-github-containers-storagesourcetrixie1.55.1+ds1-1not yet assignedNot reportedNot reported
Debiangolang-github-containers-storagesourcebookworm(unfixed)not yet assignedNot reportedNot reported
Suseskopeorpmlinux micro 6.01.14.4-2.1Not reportedSUSE-SU-2025:20085-1Not reported
Susebuildahrpmlinux enterprise module for containers 15 sp51.35.4-150500.3.19.1Not reportedSUSE-SU-2024:3754-1Not reported
Susebuildahrpmlinux enterprise module for containers 15 sp61.35.4-150500.3.19.1Not reportedSUSE-SU-2024:3754-1Not reported
Opensusebuildahrpmleap 15.51.35.4-150500.3.19.1Not reportedSUSE-SU-2024:3754-1Not reported
Opensusebuildahrpmleap 15.61.35.4-150500.3.19.1Not reportedSUSE-SU-2024:3754-1Not reported
Opensusepodmanrpmtumbleweed5.2.4-3.1Not reportedOPENSUSE-SU-2024:14420-1Not reported
Susepodmanrpmlinux enterprise micro 5.54.9.5-150500.3.28.1Not reportedSUSE-SU-2024:3753-1Not reported
Susepodmanrpmlinux enterprise module for containers 15 sp54.9.5-150500.3.28.1Not reportedSUSE-SU-2024:3753-1Not reported
Susepodmanrpmlinux enterprise module for containers 15 sp64.9.5-150500.3.28.1Not reportedSUSE-SU-2024:3753-1Not reported
Opensusepodmanrpmleap micro 5.54.9.5-150500.3.28.1Not reportedSUSE-SU-2024:3753-1Not reported
Opensusepodmanrpmleap 15.54.9.5-150500.3.28.1Not reportedSUSE-SU-2024:3753-1Not reported
Opensusepodmanrpmleap 15.64.9.5-150500.3.28.1Not reportedSUSE-SU-2024:3753-1Not reported
Opensuseskopeorpmtumbleweed1.16.1-2.1Not reportedOPENSUSE-SU-2024:14562-1Not reported
Opensusebuildahrpmtumbleweed1.37.5-1.1Not reportedOPENSUSE-SU-2024:14418-1Not reported

Notes

[bookworm] golang-github-containers-storage: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [containers-storage]Affected

    Source package: [golang-github-containers-storage]

    Details (4)

    • 1.43.0+ds1-8+b2 · amd64 · bookworm

      Affected

      dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12

    • 1.43.0+ds1-8+b2 · arm64 · bookworm

      Affected

      dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12

    • 1.48.1+ds1-2~bpo12+1 · amd64 · bookworm-backports

      Affected

      dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12

    • 1.48.1+ds1-2~bpo12+1 · arm64 · bookworm-backports

      Affected

      dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12

  • [golang-github-containers-storage-dev]Affected

    Source package: [golang-github-containers-storage]

    Details (4)

    • 1.43.0+ds1-8 · all · bookworm

      Affected

      dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12

    • 1.43.0+ds1-8 · all · bookworm

      Affected

      dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12

    • 1.48.1+ds1-2~bpo12+1 · all · bookworm-backports

      Affected

      dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12

    • 1.48.1+ds1-2~bpo12+1 · all · bookworm-backports

      Affected

      dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12

[openSUSE Tumbleweed]

  • [podman-docker]Unknown

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 5.2.4-3.1

      Version impact unknown

      dsa · podman · opensuse · tumbleweed

  • [podman-remote]Unknown

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.2.4-3.1

      Version impact unknown

      dsa · podman · opensuse · tumbleweed

  • [podmansh]Unknown

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 5.2.4-3.1

      Version impact unknown

      dsa · podman · opensuse · tumbleweed

  • [skopeo-bash-completion]Unknown

    Source package: [skopeo]

    Details (1)

    • 1.24.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.16.1-2.1

      Version impact unknown

      dsa · skopeo · opensuse · tumbleweed

  • [skopeo-fish-completion]Unknown

    Source package: [skopeo]

    Details (1)

    • 1.24.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.16.1-2.1

      Version impact unknown

      dsa · skopeo · opensuse · tumbleweed

  • [skopeo-zsh-completion]Unknown

    Source package: [skopeo]

    Details (1)

    • 1.24.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.16.1-2.1

      Version impact unknown

      dsa · skopeo · opensuse · tumbleweed

  • [buildah]Fixed

    Source package: [buildah]

    Details (1)

    • 1.44.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.37.5-1.1

      dsa · buildah · opensuse · tumbleweed

  • [podman]Fixed

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 5.2.4-3.1

      dsa · podman · opensuse · tumbleweed

  • [skopeo]Fixed

    Source package: [skopeo]

    Details (1)

    • 1.24.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.16.1-2.1

      dsa · skopeo · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [containers-storage]Fixed

    Source package: [golang-github-containers-storage]

    Details (2)

    • 1.57.2+ds1-1+b2 · amd64 · trixie

      Fixed · Fixed: 1.55.1+ds1-1

      dsa · golang-github-containers-storage · debian · 13

    • 1.57.2+ds1-1+b2 · arm64 · trixie

      Fixed · Fixed: 1.55.1+ds1-1

      dsa · golang-github-containers-storage · debian · 13

  • [golang-github-containers-storage-dev]Fixed

    Source package: [golang-github-containers-storage]

    Details (2)

    • 1.57.2+ds1-1 · all · trixie

      Fixed · Fixed: 1.55.1+ds1-1

      dsa · golang-github-containers-storage · debian · 13

    • 1.57.2+ds1-1 · all · trixie

      Fixed · Fixed: 1.55.1+ds1-1

      dsa · golang-github-containers-storage · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]