CVE-2024-9407

mediumPriorität · verfolgen · 0EPSS 0.003 · 21. PerzentilDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.29% (21st) EPSS

CVSS 4.7 · medium

Is it mine?

25 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobengovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobengovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobengovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of openSUSE Leap 15.5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobengovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobengovulncheck-vulndb-0.0.20241104T154416-5.1.noarch as component of SUSE Package Hub 12suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

5.3

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.14.7mediumAV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.14.7mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:Nsecondary · ENISA EU

v3.14.7mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:Nsecondary · secalert@redhat.com USAusnutzbarkeit 0.5 · Auswirkung 4.2

v3.14.7mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:Nsecondary · OSV

v3.14.3mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.15.3mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:Nsecondary · SUSE Product Security

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-20USCWE-20USCWE-20US

betroffene Produkte (25)

Betroffene Produkte und Versionsbereiche.

Red Hat Red Hat Enterprise Linux 8< 8100020241023085649.afee755denisa_euvdEU
Red Hat Red Hat Enterprise Linux 9< 2:1.37.5-1.el9_5enisa_euvdEU
Red Hat Red Hat Enterprise Linux 9< 4:4.9.4-16.el9_4enisa_euvdEU
Red Hat Red Hat Enterprise Linux 9< 4:5.2.2-9.el9_5enisa_euvdEU
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support< 2:1.33.11-1.el9_4enisa_euvdEU
Red Hat Red Hat OpenShift Container Platform 4.16< 416.94.202411201433-0enisa_euvdEU
Red Hat Inc. Podman≤ 5.2.4fstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 9fstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8fstec_bduRU
Red Hat Inc. Red Hat OpenShift Container Platform≤ 4fstec_bduRU
АО «ИВК» АЛЬТ СП 10alle Versionenfstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 3.1fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 11fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 12fstec_bduRU
Go github.com/containers/buildah< 1.37.4osvUSpkg:golang/github.com/containers/buildah
Go github.com/containers/podmanalle VersionenosvUSpkg:golang/github.com/containers/podman
Go github.com/containers/podman< 5.2.4osvUSpkg:golang/github.com/containers/podman
Go github.com/containers/podman/v2alle VersionenosvUSpkg:golang/github.com/containers/podman/v2
Go github.com/containers/podman/v2< 5.2.4osvUSpkg:golang/github.com/containers/podman/v2

20 von 25 angezeigt

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

SUSE-SU-2024:3911-1Security update for govulncheck-vulndb2024-11-05csaf · suse_csafDE
Security update for govulncheck-vulndb
openSUSE-SU-2024:0350-1Security update for govulncheck-vulndb2024-11-05csaf · suse_csafDE
Security update for govulncheck-vulndb
GHSA-fhqq-8f65-5xfcImproper Input Validation in Buildah and Podman2024-10-01ghsa · osvUS
A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
GO-2024-3169Improper Input Validation in Buildah and Podman in github.com/containers/buildah2024-10-09vendor · osvUS
Improper Input Validation in Buildah and Podman in github.com/containers/buildah

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv suse_csaf NVD CVE.org MITRE

veröffentlicht 2024-10-01geändert 2026-10-22

Referenzen (25)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan