CVE-2024-9675: Buildah Project Buildah

Medium severity, CVSS 4.4. EPSS: 0.4% chance of exploitation in the next 30 days.

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

Affected products

  • Buildah Project Buildah: affected versions not specified
  • Red Hat Enterprise Linux: version 8.0 only; version 9.0 only
  • Red Hat Enterprise Linux Eus: version 8.8 only; version 9.0 only; version 9.2 only; version 9.4 only
  • Red Hat Enterprise Linux For Arm 64: version 8.0_aarch64 only; version 9.0_aarch64 only
  • Red Hat Enterprise Linux For Arm 64 Eus: version 8.8_aarch64 only; version 9.0_aarch64 only; version 9.2_aarch64 only; version 9.4_aarch64 only
  • Red Hat Enterprise Linux For IBM Z Systems: version 8.0_s390x only; version 9.0_s390x only
  • Red Hat Enterprise Linux For IBM Z Systems Eus: version 8.8_s390x only; version 9.0_s390x only; version 9.2_s390x only; version 9.4_s390x only
  • Red Hat Enterprise Linux For Power Little Endian: version 8.0_ppc64le only; version 9.0_ppc64le only
  • Red Hat Enterprise Linux For Power Little Endian Eus: version 8.8_ppc64le only; version 9.0_ppc64le only; version 9.2_ppc64le only; version 9.4_ppc64le only
  • Red Hat Enterprise Linux Server Aus: version 8.6 only; version 9.2 only; version 9.4 only
  • Red Hat Enterprise Linux Server For Power Little Endian Update Services For SAP Solutions: version 8.6_ppc64le only; version 8.8_ppc64le only; version 9.0_ppc64le only; version 9.2_ppc64le only; version 9.4_ppc64le only
  • Red Hat Enterprise Linux Server Tus: version 8.6 only; version 8.8 only
  • Red Hat Enterprise Linux Update Services For SAP Solutions: version 8.6 only; version 8.8 only; version 9.0 only; version 9.2 only; version 9.4 only
  • Red Hat Openshift Container Platform: version 4.13 only; version 4.14 only; version 4.15 only; version 4.16 only; version 4.17 only

Published 2024-10-09. Last modified 2026-08-07.