Loading story…
Red Hat released fixes for CVE-2024-3727, a flaw in the widely used github.com/opencontainers/go-digest library in which digest values may not be correctly validated. The weakness can allow unexpected authenticated access to container registries using a victim’s credentials, resource exhaustion, local path traversal, and potentially additional attacks. Red Hat tracked the issue across container-related packages and issued updates for affected OpenShift, Enterprise Linux, Advanced Cluster Security, and related offerings.
The remediation was included in OpenShift Container Platform updates 4.14.34, 4.15.24, 4.16.14, and 4.16.15, as well as Migration Toolkit for Containers 1.8.4. Affected organizations should upgrade clusters and MTC deployments through their supported release channels, using the OpenShift CLI or web console where applicable; the OpenShift updates are available across supported x86_64, s390x, ppc64le, and aarch64 environments.
See affected versions and whether adversaries are exploiting it.
14 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:9960 for OpenShift API for Data Protection (OADP) 1.3 on RHEL 9, fixing CVE-2024-3727 in the oadp-velero-plugin-rhel9 component.
Red Hat issued Moderate-severity advisory RHSA-2024:9098 for Skopeo on RHEL 9. The Skopeo 1.16.1-1.el9 update remediated CVE-2024-3727 along with Go DNS-loop, sensitive URL logging, and HTTP 100-continue denial-of-service vulnerabilities.
Red Hat issued Moderate-severity advisory RHSA-2024:9097 for Buildah on Red Hat Enterprise Linux 9. Buildah version 1.37.2-1.el9 remediated CVE-2024-3727 in containers/image and CVE-2024-24791, a Go net/http denial-of-service issue.
Red Hat issued Important advisory RHSA-2024:7941 for OpenShift Container Platform 4.13.52. The update remediated CVE-2024-3727 in containers/image, CVE-2024-44082 in openstack-ironic, and CVE-2024-42353 in WebOb.
Red Hat issued Moderate-severity advisory RHSA-2024:7187, releasing OpenShift Container Platform 4.14.38 with updated RPM packages. The update remediated CVE-2024-3727 in containers/image and CVE-2024-42353, an open-redirect vulnerability in WebOb.
Red Hat issued Moderate-severity advisory RHSA-2024:7182 for OpenShift Container Platform 4.15.35. The package update remediated CVE-2024-3727 in containers/image and CVE-2024-42353, an open-redirect issue in WebOb.
Red Hat issued Important advisory RHSA-2024:7174 for OpenShift Container Platform 4.16.15. Updated images and packages addressed CVE-2024-3727 as well as issues in openstack-ironic and Go components.
Red Hat issued Important advisory RHSA-2024:7164, providing Migration Toolkit for Containers 1.8.4 for Red Hat Migration Toolkit 1 on RHEL 8 x86_64. The release fixed CVE-2024-3727 and multiple other bundled-component vulnerabilities.
Red Hat issued Moderate-severity advisory RHSA-2024:6824 for OpenShift Container Platform 4.16.14. The update fixed CVE-2024-3727 alongside vulnerabilities in golang-protobuf, the Bare Metal Operator, and QEMU.
Red Hat issued Important advisory RHSA-2024:6054 for Red Hat Advanced Cluster Security 4.4.5. Updated RHACS images fixed CVE-2024-3727 in containers/image, CVE-2024-37298 in gorilla/schema, and CVE-2024-6104 in go-retryablehttp.
Red Hat issued RHSA-2024:4960, an Important advisory delivering OpenShift Container Platform 4.14.34 updates and container images. The release remediated CVE-2024-3727, whose containers/image digest type did not guarantee a valid type.
Avinash Hanwate reported GO-2024-2824/CVE-2024-24788, in which a malformed DNS response can cause Go DNS Lookup functions to loop indefinitely and create a denial-of-service condition. The issue was tracked as Go project issue 66754, with remediation change 578375.
Red Hat addressed CVE-2024-37298, a gorilla/schema sparse-slice deserialization flaw that can cause excessive memory allocation through schema.Decoder.Decode(), across multiple RHEL and OpenShift releases as well as RHACS. The upstream fix is included in gorilla/schema version 1.4.1.
Red Hat released Moderate-severity OpenShift Container Platform 4.15.24 updates and container images. The release fixed CVE-2024-3727 in containers/image and CVE-2024-0874 in CoreDNS.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
17 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important-rated OpenShift Container Platform updates for versions 4.15, 4.16, 4.17, and 4.18, including 4.15.50, 4.16.33, 4.17.25, 4.18.8, and 4.18.9. The releases remediate **CVE-2025-30204**, a high-severity denial-of-service flaw in `golang-jwt/jwt` where JWT header parsing can cause excessive memory allocation from attacker-controlled tokens containing numerous period characters. Fixed upstream versions are 4.5.2 and 5.2.2. The updates also address **CVE-2024-11218**, a Podman/Buildah race condition that can enable container breakout, plus flaws in GRUB2, libxml2, Jinja2, BIND, and go-jose. Several releases fix **CVE-2025-29781**, in which the Bare Metal Operator's `BMCEventSubscription` custom resource could expose secrets across namespaces. Red Hat advises affected organizations to upgrade clusters through their applicable OpenShift release channels using the OpenShift CLI or web console across supported RHEL 8 and RHEL 9 platforms.
Aug 27, 2026
Red Hat released Important security updates for Red Hat OpenShift Container Platform and RHEL 9 Podman and Buildah deployments to remediate container-stack vulnerabilities, notably **CVE-2024-9675** and **CVE-2024-9676**. CVE-2024-9675 can permit arbitrary directory mounts through Buildah, while CVE-2024-9676 is a `containers/storage` symlink-traversal flaw affecting Podman, Buildah, and CRI-O. When a malicious image runs with automatically assigned user namespaces, the latter can cause container creation to block indefinitely or CRI-O to exhaust memory and crash; limited error-message disclosure is also possible to the user operating the affected software. Affected OpenShift releases include 4.12, 4.13, 4.14, 4.15, 4.16, 4.17, and 4.18, with related advisories also addressing flaws such as Dockerfile bind-propagation validation, FIPS crypto-policy mounting, Distribution JWT signing-key injection, and denial-of-service issues in Go, BIND, libxml2, GRUB2, and the Linux kernel. Red Hat advises OpenShift customers to update clusters through their supported release channels using the CLI or web console, and RHEL 9 users to deploy the updated Podman or Buildah packages for their supported architecture and subscription channel.
Aug 26, 2026
Red Hat issued **Important** security and bug-fix updates for OpenShift Container Platform 4.14, 4.15, 4.16, 4.17, and 4.18, including releases 4.14.65, 4.15.64, 4.16.60, 4.17.54, 4.18.39, and 4.18.43. The updates refresh platform packages and container images across x86_64, s390x, ppc64le, and aarch64 deployments, addressing vulnerabilities in OpenSSH, libarchive, libpng, nghttp2, Vim, GRUB2, OpenSSL, sudo, and the Linux kernel. Affected flaws include `CVE-2026-25646`, an out-of-bounds read in libpng's `png_set_quantize()` that can cause an infinite loop and read past a heap buffer, and `CVE-2026-28421`, in which crafted Vim swap files can trigger heap-buffer overflow and denial of service during recovery. Other remediated issues can enable arbitrary code execution, command injection, information disclosure, memory corruption, or denial of service; Red Hat advised OpenShift administrators to upgrade packages and release images through their appropriate release channels using the web console or OpenShift CLI.
Aug 26, 2026