This advisory covers three security vulnerabilities affecting podman and related container management tools in Red Hat Enterprise Linux 9. CVE-2024-9407 involves improper input validation in the bind-propagation option of the Dockerfile RUN --mount instruction, potentially leading to security issues. CVE-2024-9675 allows Buildah to mount arbitrary directories, which could be exploited to bypass restrictions. CVE-2024-9676 is a symlink traversal vulnerability in the containers/storage library used by Podman, Buildah, and CRI-O that can cause denial of service. Red Hat has released updated packages to fix these vulnerabilities. The affected versions are Red Hat Enterprise Linux 9 from 9.0.0 up to but excluding 9.9.0. The vendor advisory classifies the impact as Important and provides detailed update instructions.

The vulnerabilities can lead to improper input validation allowing potentially unsafe bind-propagation settings, unauthorized arbitrary directory mounts, and denial of service via symlink traversal in container storage. These issues could disrupt container operations and potentially allow unauthorized access or denial of service conditions in containerized environments managed by podman and related tools.

Red Hat has released updated packages for podman and related components that address these vulnerabilities. Users running affected versions of Red Hat Enterprise Linux 9 (>=9.0.0 <9.9.0) should apply the security updates as described in the Red Hat advisory RHSA-2024:9051 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.