Vulnerability Report: GO-2024-2842

Affected Packages

• Path
  Versions
  Symbols
• github.com/containers/image/v5/copy
  before v5.30.1
  • Image
• github.com/containers/image/v5/directory
  before v5.30.1
  8 unexported affected symbols

  • dirImageDestination.PutBlobWithOptions
  • dirImageDestination.PutManifest
  • dirImageDestination.PutSignaturesWithFormat
  • dirImageDestination.TryReusingBlobWithOptions
  • dirImageSource.GetBlob
  • dirImageSource.GetManifest
  • dirImageSource.GetSignaturesWithFormat
  • dirReference.NewImage
• github.com/containers/image/v5/docker
  before v5.30.1
  • GetRepositoryTags
  • Image.GetRepositoryTags
• github.com/containers/image/v5/docker/internal/tarfile
  before v5.30.1
  • Destination.PutBlobWithOptions
  • Destination.PutManifest
• github.com/containers/image/v5/openshift
  before v5.30.1
  7 unexported affected symbols

  • openshiftImageDestination.PutBlobWithOptions
  • openshiftImageDestination.PutManifest
  • openshiftImageDestination.TryReusingBlobWithOptions
  • openshiftImageSource.GetBlob
  • openshiftImageSource.GetManifest
  • openshiftImageSource.GetSignaturesWithFormat
  • openshiftReference.NewImage
• github.com/containers/image/v5/ostree
  before v5.30.1
  3 unexported affected symbols

  • ostreeImageDestination.Commit
  • ostreeImageDestination.TryReusingBlobWithOptions
  • ostreeImageSource.GetBlob
• github.com/containers/image/v5/pkg/blobcache
  before v5.30.1
  • BlobCache.HasBlob
  • BlobCache.NewImage
• github.com/containers/image/v5/storage
  before v5.30.1
  • ResolveReference

Aliases

• CVE-2024-3727
• GHSA-6wvf-f2vw-3425

References

• https://github.com/advisories/GHSA-6wvf-f2vw-3425
• https://github.com/containers/image/commit/132678b47bae29c710589012668cb85859d88385
• https://access.redhat.com/security/cve/CVE-2024-3727
• https://bugzilla.redhat.com/show_bug.cgi?id=2274767
• https://github.com/containers/image/releases/tag/v5.30.1
• https://vuln.go.dev/ID/GO-2024-2842.json

Feedback