CoreCVE
Back

MEDIUM

Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

Published Oct 1, 2024

Description

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.

Affected products

Remediation

Vendor solution

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-59

References (23)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Oct 1, 2024
Updated Aug 11, 2026
Reserved Sep 30, 2024
Link CVE-2024-9341
CISA Vulnrichment
Updated Oct 1, 2024
NVD
Status Modified
Modified Aug 11, 2026
Link CVE-2024-9341
Red Hat
Severity Moderate
Public date Oct 1, 2024
Links CVE-2024-9341 - Bugzilla
ENISA EUVD
Assigner redhat
Published Oct 1, 2024
Updated Aug 11, 2026
Exploited since n/a
Link EUVD-2024-3079
EUVD-2024-3079 GHSA-MC76-5925-C5P6