CVE-2024-9341

Name	CVE-2024-9341
Description	A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1084061

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-github-containers-common (PTS)	bullseye	0.33.4+ds1-1+deb11u2	vulnerable
	bookworm	0.50.1+ds1-4	vulnerable
	sid, trixie	0.60.4+ds1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang-github-containers-common	source	(unstable)	0.60.4+ds1-1			1084061

Notes

[bookworm] - golang-github-containers-common <no-dsa> (Minor issue, only affects FIPS-enabled containers)
[bullseye] - golang-github-containers-common <postponed> (Limited support, minor issue, follow bookworm DSAs/point-releases)
https://github.com/advisories/GHSA-mc76-5925-c5p6
https://github.com/containers/common/commit/e7db06585c32e1a782c1d9aa3b71ccd708f5e23f (v0.60.4)
https://bugzilla.redhat.com/show_bug.cgi?id=2315691