{ "document": { "aggregate_severity": { "text": "High" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos8.4els/vex/2024/cve-2024-3727-els_os-centos8_4els.json" } ], "tracking": { "current_release_date": "2026-08-13T12:51:22Z", "generator": { "date": "2026-08-13T12:51:22Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2024-3727-ELS_OS-CENTOS8.4ELS", "initial_release_date": "2024-05-09T00:00:00Z", "revision_history": [ { "date": "2024-05-09T00:00:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-04-08T20:34:01Z", "number": "2", "summary": "Official Publication" }, { "date": "2026-05-06T14:32:57Z", "number": "3", "summary": "Update document" }, { "date": "2026-06-12T18:44:11Z", "number": "4", "summary": "Update document" }, { "date": "2026-07-19T06:32:21Z", "number": "5", "summary": "Update document" }, { "date": "2026-08-01T21:44:07Z", "number": "6", "summary": "Update document" }, { "date": "2026-08-13T12:51:22Z", "number": "7", "summary": "Update document" } ], "status": "final", "version": "7" }, "title": "Security update on CVE-2024-3727" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 8.4", "product": { "name": "Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:8.4:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "pam-0:1.3.1-14.el8.tuxcare.els2.i686", "product": { "name": "pam-0:1.3.1-14.el8.tuxcare.els2.i686", "product_id": "pam-0:1.3.1-14.el8.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam@1.3.1-14.el8.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "pam-0:1.3.1-14.el8.tuxcare.els1.i686", "product": { "name": "pam-0:1.3.1-14.el8.tuxcare.els1.i686", "product_id": "pam-0:1.3.1-14.el8.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam@1.3.1-14.el8.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686", "product": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686", "product_id": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam-devel@1.3.1-14.el8.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686", "product": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686", "product_id": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam-devel@1.3.1-14.el8.tuxcare.els2?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "pam-0:1.3.1-14.el8.tuxcare.els2.x86_64", "product": { "name": "pam-0:1.3.1-14.el8.tuxcare.els2.x86_64", "product_id": "pam-0:1.3.1-14.el8.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam@1.3.1-14.el8.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "pam-0:1.3.1-14.el8.tuxcare.els1.x86_64", "product": { "name": "pam-0:1.3.1-14.el8.tuxcare.els1.x86_64", "product_id": "pam-0:1.3.1-14.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam@1.3.1-14.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64", "product": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64", "product_id": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam-devel@1.3.1-14.el8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64", "product": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64", "product_id": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/pam-devel@1.3.1-14.el8.tuxcare.els2?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "pam-0:1.3.1-14.el8.tuxcare.els2.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.i686" }, "product_reference": "pam-0:1.3.1-14.el8.tuxcare.els2.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-0:1.3.1-14.el8.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.x86_64" }, "product_reference": "pam-0:1.3.1-14.el8.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-0:1.3.1-14.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.x86_64" }, "product_reference": "pam-0:1.3.1-14.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-0:1.3.1-14.el8.tuxcare.els1.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.i686" }, "product_reference": "pam-0:1.3.1-14.el8.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686" }, "product_reference": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64" }, "product_reference": "pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686" }, "product_reference": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686", "relates_to_product_reference": "CentOS-8.4" }, { "category": "default_component_of", "full_product_name": { "name": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64 as a component of Community Enterprise Operating System 8.4", "product_id": "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64" }, "product_reference": "pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64", "relates_to_product_reference": "CentOS-8.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-3727", "cwe": { "id": "CWE-354", "name": "Improper Validation of Integrity Check Value" }, "notes": [ { "category": "description", "text": "A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.", "title": "Vulnerability description" }, { "category": "other", "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.", "title": "Statement" } ], "product_status": { "known_not_affected": [ "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.x86_64", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-3727" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:0045", "url": "https://access.redhat.com/errata/RHSA-2024:0045" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:3718", "url": "https://access.redhat.com/errata/RHSA-2024:3718" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:4159", "url": "https://access.redhat.com/errata/RHSA-2024:4159" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:4613", "url": "https://access.redhat.com/errata/RHSA-2024:4613" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:4850", "url": "https://access.redhat.com/errata/RHSA-2024:4850" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:4960", "url": "https://access.redhat.com/errata/RHSA-2024:4960" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:5258", "url": "https://access.redhat.com/errata/RHSA-2024:5258" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:5951", "url": "https://access.redhat.com/errata/RHSA-2024:5951" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:6054", "url": "https://access.redhat.com/errata/RHSA-2024:6054" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:6122", "url": "https://access.redhat.com/errata/RHSA-2024:6122" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:6708", "url": "https://access.redhat.com/errata/RHSA-2024:6708" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:6818", "url": "https://access.redhat.com/errata/RHSA-2024:6818" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:6824", "url": "https://access.redhat.com/errata/RHSA-2024:6824" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:7164", "url": "https://access.redhat.com/errata/RHSA-2024:7164" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:7174", "url": "https://access.redhat.com/errata/RHSA-2024:7174" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:7182", "url": "https://access.redhat.com/errata/RHSA-2024:7182" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:7187", "url": "https://access.redhat.com/errata/RHSA-2024:7187" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:7922", "url": "https://access.redhat.com/errata/RHSA-2024:7922" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:7941", "url": "https://access.redhat.com/errata/RHSA-2024:7941" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:8260", "url": "https://access.redhat.com/errata/RHSA-2024:8260" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:8425", "url": "https://access.redhat.com/errata/RHSA-2024:8425" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:9097", "url": "https://access.redhat.com/errata/RHSA-2024:9097" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:9098", "url": "https://access.redhat.com/errata/RHSA-2024:9098" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:9102", "url": "https://access.redhat.com/errata/RHSA-2024:9102" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:9960", "url": "https://access.redhat.com/errata/RHSA-2024:9960" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2024-3727", "url": "https://access.redhat.com/security/cve/CVE-2024-3727" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2274767", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274767" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4HEYS34N55G7NOQZKNEXZKQVNDGEICCD/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4HEYS34N55G7NOQZKNEXZKQVNDGEICCD/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6B37TXOKTKDBE2V26X2NSP7JKNMZOFVP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6B37TXOKTKDBE2V26X2NSP7JKNMZOFVP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYT3D2P3OJKISNFKOOHGY6HCUCQZYAVR/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYT3D2P3OJKISNFKOOHGY6HCUCQZYAVR/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLND3YDQQRWVRIUPL2G5UKXP5L3VSBBT/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLND3YDQQRWVRIUPL2G5UKXP5L3VSBBT/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DTOMYERG5ND4QFDHC4ZSGCED3T3ESRSC/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DTOMYERG5ND4QFDHC4ZSGCED3T3ESRSC/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FBZQ2ZRMFEUQ35235B2HWPSXGDCBZHFV/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FBZQ2ZRMFEUQ35235B2HWPSXGDCBZHFV/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QFXMF3VVKIZN7ZMB7PKZCSWV6MOMTGMQ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QFXMF3VVKIZN7ZMB7PKZCSWV6MOMTGMQ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFVSMR7TNLO2KPWJSW4CF64C2QMQXCIN/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFVSMR7TNLO2KPWJSW4CF64C2QMQXCIN/" } ], "release_date": "2024-05-09T00:00:00Z", "threats": [ { "category": "impact", "details": "Important" }, { "category": "impact", "date": "2026-06-12T13:06:37.424554Z", "details": "important", "product_ids": [ "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els1.x86_64", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.i686", "CentOS-8.4:pam-0:1.3.1-14.el8.tuxcare.els2.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els1.x86_64", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.i686", "CentOS-8.4:pam-devel-0:1.3.1-14.el8.tuxcare.els2.x86_64" ] } ] } ] }