CVE-2024-24783VulnerabilityPublished 3 Sep 2024Updated 11 Oct 2026

SUSE · security update for skopeo

Affects SUSESource GCVE Database

Not known to be exploited · fixed in 9.9 : update SUSE when convenient.

Data as of 25 Oct 2026, 19:02 UTC

Severity

Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.6% chance of exploitation in 30 days – higher than 51% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 9.9, 9.7, 9.5

Exploitation evidence

Disclosed: evidence found.
CVE published 3 Sep 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

microsoft-security-response-ce

What to do

Upgrade SUSE to 9.9, 9.7 or 9.5.

Affected software

Product	Affected	Fixed in
SUSE Product Security Team SUSE	Affected >=9.4 <9.5 >=9.6 <9.7 >=9.8 <9.9 Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux AppStream (v. 9) src containernetworking-plugins-1:1.4.0-5.el9_4.src Microsoft Azure Linux 2.0 CBL Mariner 2.0 3.0 SUSE x86_64 skopeo-2:1.14.5-1.el9_4.x86_64 skopeo-tests-2:1.14.5-1.el9_4.x86_64 SUSE Linux Enterprise	Fixed in 9.5 9.7 9.9

AI-suggested

Red Hat has released official security updates for containernetworking-plugins and gvisor-tap-vsock packages in Red Hat Enterprise Linux 9. Users should apply these updates as detailed in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate the vulnerability. No additional mitigation steps are indicated by the vendor.

Description

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Impact

The vulnerability causes a panic in the certificate verification process, which could disrupt network connectivity or related operations in container networking plugins and podman-machine virtual machines. The impact is rated moderate, indicating a potential denial of service or stability issue but no direct code execution or privilege escalation is described.

Summary

CVE-2024-24783 is a vulnerability in the golang crypto/x509 package where the Verify function panics when processing certificates that use an unknown public key algorithm. This affects Red Hat's containernetworking-plugins and gvisor-tap-vsock packages, which are used for container network interface configuration and networking for podman-machine VMs, respectively. The vulnerability is rated moderate by Red Hat Product Security. Security updates have been released for multiple Red Hat Enterprise Linux 9 versions and architectures to fix this issue.

CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.
Architecture and Design · Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
OWASP Cheat Sheets
Transport Layer Protection (opens in a new tab)
TLS Cipher String (opens in a new tab)
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V9.2.1 (opens in a new tab)
V1.9.2 (opens in a new tab)
V2.8.5 (opens in a new tab)
Attack patterns
Creating a Rogue Certification Authority Certificate (opens in a new tab)
Signature Spoofing by Improper Validation (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-476NULL Pointer Dereference (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #13OWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
The product dereferences a pointer that it expects to be valid but is NULL.
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
Requirements
Select a programming language that is not susceptible to these issues.
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
OWASP Cheat Sheets
Logging (opens in a new tab)
Error Handling (opens in a new tab)
OWASP ASVS 4.0.3
V11.1.7 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 4 Aug 2026, 16:56 UTC

WeaknessesCWE-295, CWE-476

Technical details

References

Community reviews

Related threats