SARA / Free Tools / CVE / CVE-2024-3727

CVE-2024-3727 — A flaw was found in the github

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

CVSS
8.3 HIGH
EPSS
56.00% (top 32.00%)
CWE
CWE-354
Published
2024-05-09T14:57:21.327Z
Last modified
2026-03-19T01:12:10.150Z
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

01What is this vulnerability?

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

02Affected products

VendorProductVersions
??0, 5.30.0
Red HatOADP1.3-RHEL-9 — 1.3.4-9
Red HatRed Hat Advanced Cluster Security 4.44.4.5-2
Red HatRed Hat Advanced Cluster Security 4.44.4.5-2
Red HatRed Hat Advanced Cluster Security 4.44.4.5-2
Red HatRed Hat Advanced Cluster Security 4.44.4.5-4
Red HatRed Hat Advanced Cluster Security 4.44.4.5-3
Red HatRed Hat Advanced Cluster Security 4.44.4.5-2
Red HatRed Hat Advanced Cluster Security 4.44.4.5-2
Red HatRed Hat Advanced Cluster Security 4.44.4.5-2
Red HatRed Hat Advanced Cluster Security 4.44.4.5-3
Red HatRed Hat Advanced Cluster Security 4.44.4.5-2
Red HatRed Hat Advanced Cluster Security 4.44.4.5-2
Red HatRed Hat Advanced Cluster Security 4.44.4.5-3
Red HatRed Hat Advanced Cluster Security 4.44.4.5-3
Red HatRed Hat Advanced Cluster Security 4.54.5.2-2
Red HatRed Hat Advanced Cluster Security 4.54.5.2-2
Red HatRed Hat Advanced Cluster Security 4.54.5.2-2
Red HatRed Hat Advanced Cluster Security 4.54.5.2-2
Red HatRed Hat Advanced Cluster Security 4.54.5.2-2
Red HatRed Hat Advanced Cluster Security 4.54.5.2-2
Red HatRed Hat Advanced Cluster Security 4.54.5.2-2
Red HatRed Hat Advanced Cluster Security 4.54.5.2-2
Red HatRed Hat Advanced Cluster Security 4.54.5.2-2
Red HatRed Hat Advanced Cluster Security 4.54.5.2-2
Red HatRed Hat Advanced Cluster Security 4.54.5.2-1
Red HatRed Hat Advanced Cluster Security 4.54.5.2-2
Red HatRed Hat Advanced Cluster Security 4.54.5.2-2
Red HatRed Hat Enterprise Linux 88100020240808093819.afee755d
Red HatRed Hat Enterprise Linux 92:1.37.2-1.el9
Red HatRed Hat Enterprise Linux 92:1.16.1-1.el9
Red HatRed Hat Enterprise Linux 92:5.2.2-1.el9
Red HatRed Hat Migration Toolkit for Containers 1.8v1.8.4-22
Red HatRed Hat OpenShift Container Platform 4.133:4.4.1-14.rhaos4.13.el9
Red HatRed Hat OpenShift Container Platform 4.132:1.11.3-3.rhaos4.13.el8
Red HatRed Hat OpenShift Container Platform 4.14v4.14.0-202407260439.p0.g8d9b39e.assembly.stream.el8
Red HatRed Hat OpenShift Container Platform 4.143:4.4.1-19.rhaos4.14.el8
Red HatRed Hat OpenShift Container Platform 4.142:1.11.3-3.rhaos4.14.el9
Red HatRed Hat OpenShift Container Platform 4.15v4.15.0-202409172305.p0.g17536c8.assembly.stream.el8
Red HatRed Hat OpenShift Container Platform 4.15v4.15.0-202409171307.p0.ged4651a.assembly.stream.el8
Red HatRed Hat OpenShift Container Platform 4.15v4.15.0-202409161436.p0.g1f44c02.assembly.stream.el9
Red HatRed Hat OpenShift Container Platform 4.15v4.15.0-202409120135.p0.gf7f5eed.assembly.stream.el9
Red HatRed Hat OpenShift Container Platform 4.15v4.15.0-202409131835.p0.gadccbd5.assembly.stream.el9
Red HatRed Hat OpenShift Container Platform 4.15v4.15.0-202409120135.p0.g8425d88.assembly.stream.el9
Red HatRed Hat OpenShift Container Platform 4.15v4.15.0-202409130735.p0.gc03231f.assembly.stream.el9
Red HatRed Hat OpenShift Container Platform 4.15v4.15.0-202409131635.p0.gb73e37f.assembly.stream.el9
Red HatRed Hat OpenShift Container Platform 4.15v4.15.0-202409161836.p0.g092d15b.assembly.stream.el9
Red HatRed Hat OpenShift Container Platform 4.15v4.15.0-202409180105.p0.g1fdd5b0.assembly.stream.el9
Red HatRed Hat OpenShift Container Platform 4.15v4.15.0-202409180905.p0.gf6f61ca.assembly.stream.el8
Red HatRed Hat OpenShift Container Platform 4.15v4.15.0-202409171307.p0.g160e7ca.assembly.stream.el8

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection in your stack of choice:

Open in Sigma generator →

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

09References

Want this in your SOAR or SIEM?
SARA's API returns EPSS, CVSS, KEV, and an analyst-grade summary in one call.
Read the API reference →