Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 934141 (CVE-2024-3727)

Summary: <app-containers/apptainer-1.3.2: unexpected authenticated registry access vulnerability in bundled library containers/image
Product: Gentoo Security Reporter: Marek Szuba <marecki>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: CONFIRMED ---    
Severity: normal CC: maintainer-needed, marecki
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://github.com/advisories/GHSA-6wvf-f2vw-3425
Whiteboard:
Package list:
Runtime testing required: ---
Bug Depends on: 934142    
Bug Blocks:    

Description Marek Szuba (RETIRED) archtester gentoo-dev 2024-06-12 13:01:07 UTC
Fixed in apptainer-1.3.2, which I am about to push to the tree.
Comment 1 Larry the Git Cow gentoo-dev 2024-06-13 11:37:15 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c657731a4add4f9d49bdaad3cabbfe31352d1c37

commit c657731a4add4f9d49bdaad3cabbfe31352d1c37
Author:     Marek Szuba <marecki@gentoo.org>
AuthorDate: 2024-06-13 10:41:24 +0000
Commit:     Marek Szuba <marecki@gentoo.org>
CommitDate: 2024-06-13 11:36:54 +0000

    app-containers/apptainer: drop 1.3.0
    
    No versions vulnerable to CVE-2024-3727 left in the tree.
    
    Bug: https://bugs.gentoo.org/934141
    Signed-off-by: Marek Szuba <marecki@gentoo.org>

 app-containers/apptainer/Manifest               |  1 -
 app-containers/apptainer/apptainer-1.3.0.ebuild | 92 -------------------------
 2 files changed, 93 deletions(-)