Y2Y2
Explore more on Y2
Public vulnerability disclosure
Investigate in Cyber
Open

CVE-2024-9407

Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction

publishedCWE-20

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

Technical severity4.7 mediumCVSS 3.1 · CNA: redhat
Published2024-10-01Source updated 2026-11-05
Collected2026-11-053 attributed sources

Fixes and workarounds

Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Source: CNA: redhat

Fix

github.com/containers/buildah (Go): OSV reports a fixed version 1.37.4. Check the advisory for supported release branches.

Source: OSV GHSA-fhqq-8f65-5xfc

Fix

github.com/containers/podman/v5 (Go): OSV reports a fixed version 5.2.4. Check the advisory for supported release branches.

Source: OSV GHSA-fhqq-8f65-5xfc

Fix

github.com/containers/podman (Go): OSV reports a fixed version 5.2.4. Check the advisory for supported release branches.

Source: OSV GHSA-fhqq-8f65-5xfc

Fix

github.com/containers/podman/v2 (Go): OSV reports a fixed version 5.2.4. Check the advisory for supported release branches.

Source: OSV GHSA-fhqq-8f65-5xfc

Fix

github.com/containers/podman/v3 (Go): OSV reports a fixed version 5.2.4. Check the advisory for supported release branches.

Source: OSV GHSA-fhqq-8f65-5xfc

Fix

github.com/containers/podman/v4 (Go): OSV reports a fixed version 5.2.4. Check the advisory for supported release branches.

Source: OSV GHSA-fhqq-8f65-5xfc

Affected products and versions

ProductVersionsAuthority


podman
https://github.com/containers/podman 		≥ 0; < 5.2.4 (affected, semver)
Other versions: unaffected 		CNA: redhat


buildah
https://github.com/containers/buildah 		≥ 0; < 1.37.4 (affected, semver)
Other versions: unaffected 		CNA: redhat
Red Hat Enterprise Linux 8
Red Hat
container-tools:rhel8
https://access.redhat.com/downloads/content/package-browser/ 		≥ 8100020241023085649.afee755d; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9
Red Hat
podman
https://access.redhat.com/downloads/content/package-browser/ 		≥ 4:4.9.4-16.el9_4; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9
Red Hat
podman
https://access.redhat.com/downloads/content/package-browser/ 		≥ 4:5.2.2-9.el9_5; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9
Red Hat
buildah
https://access.redhat.com/downloads/content/package-browser/ 		≥ 2:1.37.5-1.el9_5; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9.4 Extended Update Support
Red Hat
buildah
https://access.redhat.com/downloads/content/package-browser/ 		≥ 2:1.33.11-1.el9_4; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 4.16
Red Hat
openshift/ose-rhel-coreos-9
https://catalog.redhat.com/software/containers/ 		≥ 416.94.202411201433-0; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 10
Red Hat
buildah
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 10
Red Hat
podman
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 4
Red Hat
buildah
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: unaffected 		CNA: redhat
Red Hat OpenShift Container Platform 4
Red Hat
openshift4/ose-docker-builder
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat
github.com/containers/buildah

github.com/containers/buildah
Go 		≥ 0; < 1.37.4 (affected, semver); OSV events: introduced 0; fixed 1.37.4
Source events (semver) 
[
  {
    "introduced": "0"
  },
  {
    "fixed": "1.37.4"
  }
]

Other versions: unaffected 		OSV GHSA-fhqq-8f65-5xfc
github.com/containers/podman/v5

github.com/containers/podman/v5
Go 		≥ 0; < 5.2.4 (affected, semver); OSV events: introduced 0; fixed 5.2.4
Source events (semver) 
[
  {
    "introduced": "0"
  },
  {
    "fixed": "5.2.4"
  }
]

Other versions: unaffected 		OSV GHSA-fhqq-8f65-5xfc
github.com/containers/podman

github.com/containers/podman
Go 		≥ 0; < 5.2.4 (affected, semver); OSV events: introduced 0; fixed 5.2.4
Source events (semver) 
[
  {
    "introduced": "0"
  },
  {
    "fixed": "5.2.4"
  }
]

Other versions: unaffected 		OSV GHSA-fhqq-8f65-5xfc
github.com/containers/podman/v2

github.com/containers/podman/v2
Go 		≥ 0; < 5.2.4 (affected, semver); OSV events: introduced 0; fixed 5.2.4
Source events (semver) 
[
  {
    "introduced": "0"
  },
  {
    "fixed": "5.2.4"
  }
]

Other versions: unaffected 		OSV GHSA-fhqq-8f65-5xfc
github.com/containers/podman/v3

github.com/containers/podman/v3
Go 		≥ 0; < 5.2.4 (affected, semver); OSV events: introduced 0; fixed 5.2.4
Source events (semver) 
[
  {
    "introduced": "0"
  },
  {
    "fixed": "5.2.4"
  }
]

Other versions: unaffected 		OSV GHSA-fhqq-8f65-5xfc
github.com/containers/podman/v4

github.com/containers/podman/v4
Go 		≥ 0; < 5.2.4 (affected, semver); OSV events: introduced 0; fixed 5.2.4
Source events (semver) 
[
  {
    "introduced": "0"
  },
  {
    "fixed": "5.2.4"
  }
]

Other versions: unaffected 		OSV GHSA-fhqq-8f65-5xfc

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

Version / scoreVectorAuthority
3.1 / 4.7
medium		 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:NCNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

For agents and automation

Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.

Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.

Get an API keyUse x402Connect an agent
Endpoints and access details

https://api.y2.dev/api/v2/cyber/cves
https://api.y2.dev/api/v2/cyber/cves/{cveId}

A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.

For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.

Agent access JSON · OpenAPI · CVE API guide