{"id":"CVE-2024-9675","title":"A vulnerability was found in Buildah","summary":"A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-22"],"vendor":"buildah_project","product":"buildah","affected":["buildah","openshift_container_platform = 4.13","openshift_container_platform = 4.14","openshift_container_platform = 4.15","openshift_container_platform = 4.16","openshift_container_platform = 4.17","enterprise_linux = 8.0","enterprise_linux = 9.0","enterprise_linux_eus = 8.8","enterprise_linux_eus = 9.0","enterprise_linux_eus = 9.2","enterprise_linux_eus = 9.4","enterprise_linux_for_arm_64 = 8.0_aarch64","enterprise_linux_for_arm_64 = 9.0_aarch64","enterprise_linux_for_arm_64_eus = 8.8_aarch64","enterprise_linux_for_arm_64_eus = 9.0_aarch64","enterprise_linux_for_arm_64_eus = 9.2_aarch64","enterprise_linux_for_arm_64_eus = 9.4_aarch64","enterprise_linux_for_ibm_z_systems = 8.0_s390x","enterprise_linux_for_ibm_z_systems = 9.0_s390x","enterprise_linux_for_ibm_z_systems_eus = 8.8_s390x","enterprise_linux_for_ibm_z_systems_eus = 9.0_s390x","enterprise_linux_for_ibm_z_systems_eus = 9.2_s390x","enterprise_linux_for_ibm_z_systems_eus = 9.4_s390x","enterprise_linux_for_power_little_endian = 8.0_ppc64le","enterprise_linux_for_power_little_endian = 9.0_ppc64le","enterprise_linux_for_power_little_endian_eus = 8.8_ppc64le","enterprise_linux_for_power_little_endian_eus = 9.0_ppc64le","enterprise_linux_for_power_little_endian_eus = 9.2_ppc64le","enterprise_linux_for_power_little_endian_eus = 9.4_ppc64le","enterprise_linux_server_aus = 8.6","enterprise_linux_server_aus = 9.2","enterprise_linux_server_aus = 9.4","enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 8.6_ppc64le","enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 8.8_ppc64le","enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.0_ppc64le","enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.2_ppc64le","enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.4_ppc64le","enterprise_linux_server_tus = 8.6","enterprise_linux_server_tus = 8.8","enterprise_linux_update_services_for_sap_solutions = 8.6","enterprise_linux_update_services_for_sap_solutions = 8.8","enterprise_linux_update_services_for_sap_solutions = 9.0","enterprise_linux_update_services_for_sap_solutions = 9.2","enterprise_linux_update_services_for_sap_solutions = 9.4"],"published":"2024-10-09","updated":"2026-06-25","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-9675","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:8563","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8675","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8679","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8686","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8690","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8700","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8703","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8707","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8708","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8709","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8846","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8984","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8994","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:9051","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:9454","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:9459","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:2445","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:2449","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:2454","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:2701","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:2710","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:3301","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:3573","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2024-9675","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317458","label":"secalert@redhat.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9675"},{"url":"https://github.com/containers/buildah/commit/aa67e5d71ee7ec07122a210baa3b13966a9e086c"},{"url":"https://pkg.go.dev/vuln/GO-2024-3186"},{"url":"https://github.com/containers/buildah"},{"url":"https://access.redhat.com/errata/RHBA-2024:10967"}],"tags":["nvd","osv","go","score-dispute"],"epss":0.00392,"epssPercentile":0.33137,"ingestedAt":"2026-06-29T13:24:33.968Z","aliases":["GHSA-586p-749j-fhwp","GO-2024-3186"],"ecosystem":"go","patched":["github.com/containers/buildah 1.38.0"],"scores":{"nvd":7.8,"osv":4.4},"slug":"CVE-2024-9675","body":"## Overview\n\nA vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.\n\n## Affected\n\n- `buildah`\n- `openshift_container_platform = 4.13`\n- `openshift_container_platform = 4.14`\n- `openshift_container_platform = 4.15`\n- `openshift_container_platform = 4.16`\n- `openshift_container_platform = 4.17`\n- `enterprise_linux = 8.0`\n- `enterprise_linux = 9.0`\n- `enterprise_linux_eus = 8.8`\n- `enterprise_linux_eus = 9.0`\n- `enterprise_linux_eus = 9.2`\n- `enterprise_linux_eus = 9.4`\n- `enterprise_linux_for_arm_64 = 8.0_aarch64`\n- `enterprise_linux_for_arm_64 = 9.0_aarch64`\n- `enterprise_linux_for_arm_64_eus = 8.8_aarch64`\n- `enterprise_linux_for_arm_64_eus = 9.0_aarch64`\n- `enterprise_linux_for_arm_64_eus = 9.2_aarch64`\n- `enterprise_linux_for_arm_64_eus = 9.4_aarch64`\n- `enterprise_linux_for_ibm_z_systems = 8.0_s390x`\n- `enterprise_linux_for_ibm_z_systems = 9.0_s390x`\n- `enterprise_linux_for_ibm_z_systems_eus = 8.8_s390x`\n- `enterprise_linux_for_ibm_z_systems_eus = 9.0_s390x`\n- `enterprise_linux_for_ibm_z_systems_eus = 9.2_s390x`\n- `enterprise_linux_for_ibm_z_systems_eus = 9.4_s390x`\n- `enterprise_linux_for_power_little_endian = 8.0_ppc64le`\n- `enterprise_linux_for_power_little_endian = 9.0_ppc64le`\n- `enterprise_linux_for_power_little_endian_eus = 8.8_ppc64le`\n- `enterprise_linux_for_power_little_endian_eus = 9.0_ppc64le`\n- `enterprise_linux_for_power_little_endian_eus = 9.2_ppc64le`\n- `enterprise_linux_for_power_little_endian_eus = 9.4_ppc64le`\n- `enterprise_linux_server_aus = 8.6`\n- `enterprise_linux_server_aus = 9.2`\n- `enterprise_linux_server_aus = 9.4`\n- `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 8.6_ppc64le`\n- `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 8.8_ppc64le`\n- `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.0_ppc64le`\n- `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.2_ppc64le`\n- `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.4_ppc64le`\n- `enterprise_linux_server_tus = 8.6`\n- `enterprise_linux_server_tus = 8.8`\n- `enterprise_linux_update_services_for_sap_solutions = 8.6`\n- `enterprise_linux_update_services_for_sap_solutions = 8.8`\n- `enterprise_linux_update_services_for_sap_solutions = 9.0`\n- `enterprise_linux_update_services_for_sap_solutions = 9.2`\n- `enterprise_linux_update_services_for_sap_solutions = 9.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2024-9675)\n\nAffected packages:\n\n- `github.com/containers/buildah < 1.38.0`\n\nPatched in:\n\n- `github.com/containers/buildah 1.38.0`\n\nSource: https://osv.dev/vulnerability/GHSA-586p-749j-fhwp","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}