CVE-2024-9675: Github.com/containers/buildah Buildah Allows Arbitrary Directory Mount Vulnerability

Q: What is CVE-2024-9675?

CVE-2024-9675 is a security vulnerability in Github.com/containers/buildah involving Buildah allows arbitrary directory mount under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

Q: Which Github.com/containers/buildah versions are affected?

Affected versions include releases prior to 1.38.0 across affected packages: github.com/containers/buildah.

Q: What version fixes CVE-2024-9675?

Upgrading to 1.38.0 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is github.com/containers/buildah affected?

Yes, github.com/containers/buildah is affected in releases prior to 1.38.0. Upgrade your dependency to 1.38.0 or later.

Q: What is the CVSS score of CVE-2024-9675?

CVE-2024-9675 has a CVSS v3.1 base score of 4.4 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Q: What CWE is associated with CVE-2024-9675?

CVE-2024-9675 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).

Q: How can I check Go dependencies for CVE-2024-9675?

Run the dependency tree command: 'inspect dependencies for github.com/containers/buildah'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

MODERATE

Advisory Identifier: GHSA-586p-749j-fhwp

CVSS 4.4

CWE-22

Published 2024-10-09

Advisory Summary

CVE-2024-9675 is a MODERATE (CVSS 4.4) buildah allows arbitrary directory mount vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Github.com/containers/buildah libraries in the Go ecosystem. The issue involves buildah allows arbitrary directory mount. Remediation is available by upgrading affected packages to version 1.38.0.

CVE-2024-9675 at a Glance

CVE Identifier CVE-2024-9675

GHSA Identifier GHSA-586p-749j-fhwp

Severity MODERATE

CVSS v3.1 Base Score 4.4

CWE Classification CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Product Github.com/containers/buildah

Package Ecosystem Go

Published Date 2024-10-09

Last Updated 2026-08-07

Security Impact

CVSS: 4.4

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

Attack Vector Local (AV:L)

Attack Complexity Low (AC:L)

Privileges Required Low (PR:L)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality Low (C:L)

Integrity Low (I:L)

Availability None (A:N)

How to Fix CVE-2024-9675

To remediate this vulnerability, upgrade all affected Github.com/containers/buildah dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/containers/buildah fixed: 1.38.0

Upgrade github.com/containers/buildah to 1.38.0

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for github.com/containers/buildah

How to Check if You Are Affected

To determine whether your application is affected by CVE-2024-9675, inspect your project dependencies for Github.com/containers/buildah:

inspect dependencies for github.com/containers/buildah

Analyze the terminal output to locate any version of Github.com/containers/buildah in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.38.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Github.com/containers/buildah, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

CVE-2024-9675 Affected Github.com/containers/buildah Versions

1 component(s)

Fixed Versions:

1.38.0

Product / Package	Ecosystem	Affected Versions	Fixed Version
github.com/containers/buildah golang/github.com/containers/buildah	Go	< 1.38.0	1.38.0

References

NVD — CVE-2024-9675 NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-9675

Security Fix Commit FIX COMMIT

https://github.com/containers/buildah/commit/aa67e5d71ee7ec07122a210baa3b13966a9e086c

pkg.go.dev/vuln/go-2024-3186 WEB

https://pkg.go.dev/vuln/GO-2024-3186

Github.com/containers/buildah Source Repository REPOSITORY

https://github.com/containers/buildah

bugzilla.redhat.com/show_bug.cgi WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2317458

Github.com/containers/buildah Security Information SECURITY

https://access.redhat.com/security/cve/CVE-2024-9675

access.redhat.com/errata/rhsa-2025:35... WEB

https://access.redhat.com/errata/RHSA-2025:3573

access.redhat.com/errata/rhsa-2025:33... WEB

https://access.redhat.com/errata/RHSA-2025:3301

access.redhat.com/errata/rhsa-2025:27... WEB

https://access.redhat.com/errata/RHSA-2025:2710

access.redhat.com/errata/rhsa-2025:27... WEB

https://access.redhat.com/errata/RHSA-2025:2701

access.redhat.com/errata/rhsa-2025:24... WEB

https://access.redhat.com/errata/RHSA-2025:2454

access.redhat.com/errata/rhsa-2025:24... WEB

https://access.redhat.com/errata/RHSA-2025:2449

access.redhat.com/errata/rhsa-2025:24... WEB

https://access.redhat.com/errata/RHSA-2025:2445

access.redhat.com/errata/rhsa-2024:94... WEB

https://access.redhat.com/errata/RHSA-2024:9459

access.redhat.com/errata/rhsa-2024:94... WEB

https://access.redhat.com/errata/RHSA-2024:9454

access.redhat.com/errata/rhsa-2024:90... WEB

https://access.redhat.com/errata/RHSA-2024:9051

access.redhat.com/errata/rhsa-2024:89... WEB

https://access.redhat.com/errata/RHSA-2024:8994

access.redhat.com/errata/rhsa-2024:89... WEB

https://access.redhat.com/errata/RHSA-2024:8984

access.redhat.com/errata/rhsa-2024:88... WEB

https://access.redhat.com/errata/RHSA-2024:8846

access.redhat.com/errata/rhsa-2024:87... WEB

https://access.redhat.com/errata/RHSA-2024:8709

access.redhat.com/errata/rhsa-2024:87... WEB

https://access.redhat.com/errata/RHSA-2024:8708

access.redhat.com/errata/rhsa-2024:87... WEB

https://access.redhat.com/errata/RHSA-2024:8707

access.redhat.com/errata/rhsa-2024:87... WEB

https://access.redhat.com/errata/RHSA-2024:8703

access.redhat.com/errata/rhsa-2024:87... WEB

https://access.redhat.com/errata/RHSA-2024:8700

access.redhat.com/errata/rhsa-2024:86... WEB

https://access.redhat.com/errata/RHSA-2024:8690

access.redhat.com/errata/rhsa-2024:86... WEB

https://access.redhat.com/errata/RHSA-2024:8686

access.redhat.com/errata/rhsa-2024:86... WEB

https://access.redhat.com/errata/RHSA-2024:8679

access.redhat.com/errata/rhsa-2024:86... WEB

https://access.redhat.com/errata/RHSA-2024:8675

access.redhat.com/errata/rhsa-2024:85... WEB

https://access.redhat.com/errata/RHSA-2024:8563

access.redhat.com/errata/rhba-2024:10... WEB

https://access.redhat.com/errata/RHBA-2024:10967

Frequently Asked Questions

What is CVE-2024-9675?

CVE-2024-9675 is a security vulnerability in Github.com/containers/buildah involving Buildah allows arbitrary directory mount under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

Which Github.com/containers/buildah versions are affected?

Affected versions include releases prior to 1.38.0 across affected packages: github.com/containers/buildah.

What version fixes CVE-2024-9675?

Upgrading to 1.38.0 (or the latest patched release for your respective branch) resolves the vulnerability.

Is github.com/containers/buildah affected?

Yes, github.com/containers/buildah is affected in releases prior to 1.38.0. Upgrade your dependency to 1.38.0 or later.

What is the CVSS score of CVE-2024-9675?

CVE-2024-9675 has a CVSS v3.1 base score of 4.4 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

What CWE is associated with CVE-2024-9675?

CVE-2024-9675 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).

How can I check Go dependencies for CVE-2024-9675?

Run the dependency tree command: 'inspect dependencies for github.com/containers/buildah'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-586p-749j-fhwp",
  "modified" : "2026-08-07T15:32:55Z",
  "published" : "2024-10-09T15:32:21Z",
  "aliases" : [ "CVE-2024-9675" ],
  "summary" : "Buildah allows arbitrary directory mount",
  "details" : "A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/containers/buildah"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.38.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-9675"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/containers/buildah/commit/aa67e5d71ee7ec07122a210baa3b13966a9e086c"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2024-3186"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/containers/buildah"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2317458"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2024-9675"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:3573"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:3301"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:2710"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:2701"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:2454"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:2449"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:2445"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:9459"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:9454"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:9051"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:8994"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:8984"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:8846"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:8709"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:8708"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:8707"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:8703"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:8700"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:8690"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:8686"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:8679"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:8675"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2024:8563"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHBA-2024:10967"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-10-09T19:15:02Z",
    "nvd_published_at" : "2024-10-09T15:15:17Z"
  }
}

CVSS V3

4.4 MODERATE

Attack Vector Local (AV:L)

Attack Complexity Low (AC:L)

Privileges Required Low (PR:L)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality Low (C:L)

Integrity Low (I:L)

Availability None (A:N)

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Advisory Metadata

Source ID: GHSA-586p-749j-fhwp
Schema Version: 1.4.0
Published: 2024-10-09 15:32
Last Modified: 2026-08-07 15:32
Database Record File: advisories/github-reviewed/2024/10/GHSA-586p-749j-fhwp/GHSA-586p-749j-fhwp.json