CVE-2024-3727 is a vulnerability in the containers/image library where the digest type does not guarantee a valid type, resulting in improper validation of the integrity check value. This can be exploited to trigger unexpected authenticated registry accesses on behalf of a victim user, which may cause resource exhaustion, local path traversal, and other attacks. The vulnerability has a CVSS 3.1 base score of 8.3 (High) with network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. Red Hat has released security updates for OpenShift Container Platform 4.16 and 4.17 that include fixes for this vulnerability, advising users to upgrade to these updated packages and images.

The vulnerability allows attackers to cause unexpected authenticated registry accesses as a victim user, which can lead to resource exhaustion, local path traversal, and potentially other unspecified attacks. The CVSS score of 8.3 indicates a high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time. The issue affects OpenShift Container Platform versions 4.16 and 4.17 as distributed by Red Hat.

Red Hat has provided official fixes for this vulnerability in OpenShift Container Platform versions 4.16 and 4.17 through updated RPM packages and container images. Users should upgrade to these updated versions using the OpenShift CLI (oc) or web console as soon as the updates are available in their release channels. Detailed upgrade instructions are available in the Red Hat OpenShift documentation. Patch status is confirmed as fixed by Red Hat advisories RHSA-2024:0045 and RHSA-2024:3718.