Unexpected Authenticated Registry Access in github.com/containers/image
Summary
CVE-2024-3727: github.com/containers/image allows unexpected authenticated registry accesses. Affects github.com/containers/image versions < 5.30.1. Fixed in 5.30.1. How to fix ↓
Also tracked for
- github.com/containers/image/v5 · Go
- golang-github-containers-image · Debian:11
The same CVE-2024-3727 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/containers/image is a Go package that provides a library for working with container images. It allows users to interact with container registries, pull and push images, and perform various operations on container images. This package is widely used in the Go ecosystem for container-related tasks.
Vulnerability Detail
A vulnerability has been discovered in the github.com/containers/image library that enables attackers to trigger unexpected authenticated registry accesses on behalf of a victim user. This can lead to resource exhaustion, local path traversal, and other malicious activities. The vulnerability originates from a flaw in the library's authentication mechanism, allowing unauthorized access to registry resources. Attackers can exploit this vulnerability to perform unauthorized actions and potentially compromise the integrity and confidentiality of container images.
How To Fix
Minimum fixed version
5.30.1
This is the first release that contains the fix.
go get github.com/containers/image@v5.30.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in github.com/containers/image allows unexpected authenticated registry accesses, posing a significant risk to container image integrity and confidentiality. It is crucial to upgrade to the latest version of the package and implement proper authentication and authorization mechanisms to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containers/image →
FAQ
The vulnerability allows attackers to perform unexpected authenticated registry accesses, leading to resource exhaustion, local path traversal, and potential compromise of container image integrity and confidentiality.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file.
Currently, there are no known workarounds for this vulnerability. It is recommended to upgrade the github.com/containers/image package to the latest version to mitigate the risk.
Yes, the vulnerability requires authentication to exploit. Attackers need to have valid credentials or access tokens to perform unauthorized registry accesses on behalf of a victim user.
Yes, this vulnerability has been reviewed by GitHub and the advisory can be found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-6wvf-f2vw-3425/GHSA-6wvf-f2vw-3425.json
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/image.
