VulnerableCode Package Details - pkg:rpm/redhat/podman@4:4.9.4-16?arch=el9

Search for packages

Vulnerability	Summary	Fixed by
VCID-e14a-39np-13bx Aliases: CVE-2024-9407 GHSA-fhqq-8f65-5xfc	Improper Input Validation in Buildah and Podman A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.	There are no reported fixed by versions.
VCID-j9nr-4d4t-j3e1 Aliases: CVE-2024-9675 GHSA-586p-749j-fhwp	Buildah allows arbitrary directory mount A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.	There are no reported fixed by versions.
VCID-zcxt-ccb2-eufc Aliases: CVE-2024-9676	Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-e14a-39np-13bx
Aliases:
CVE-2024-9407
GHSA-fhqq-8f65-5xfc

Improper Input Validation in Buildah and Podman A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

There are no reported fixed by versions.

VCID-j9nr-4d4t-j3e1
Aliases:
CVE-2024-9675
GHSA-586p-749j-fhwp

Buildah allows arbitrary directory mount A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

There are no reported fixed by versions.

VCID-zcxt-ccb2-eufc
Aliases:
CVE-2024-9676

Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)

There are no reported fixed by versions.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T13:44:58.535342+00:00	RedHat Importer	Affected by	VCID-e14a-39np-13bx	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-9407.json	38.0.0
2026-04-01T13:44:47.636075+00:00	RedHat Importer	Affected by	VCID-j9nr-4d4t-j3e1	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-9675.json	38.0.0
2026-04-01T13:44:45.754189+00:00	RedHat Importer	Affected by	VCID-zcxt-ccb2-eufc	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-9676.json	38.0.0