Detections
Analytics

Alpine: multiple buildah packages: security update to 1.37.4-r0

medium Tenable Self-Hosted Container Security Plugin ID 426142

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle
 certain file paths due to improper validation in the containers/common Go library. This flaw allows an
 attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a
 container. This issue also allows attackers to access critical host files, bypassing the intended
 isolation between containers and the host system. (CVE-2024-9341)

 - A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The
 system does not properly validate the input passed to this option, allowing users to pass arbitrary
 parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the
 host into a container during the build process and, in some cases, modify the contents of those mounted
 files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source
 directory to be relabeled to give the container access to host files. (CVE-2024-9407)

See Also

https://security.alpinelinux.org/vuln/CVE-2024-9341

https://security.alpinelinux.org/vuln/CVE-2024-9407

Plugin Details

Severity: Medium

ID: 426142

Version: Revision 1.3

Type: Local

Published: 5/16/2025

Updated: 12/4/2025

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.9

Percentile: 52.7

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:N

CVSS Score Source: CVE-2024-9341

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.9

Threat Score: 2.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2024-9407

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/1/2024

Reference Information

CVE: CVE-2024-9341, CVE-2024-9407

IAVA: 2024-A-0599