Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

🗓️ 15 Apr 2024 07:00:00Reported by MicrosoftType

Incorrect handling of supplementary groups in the container engine may allow disclosure or modification if an attacker can run code in the container.

Reporter	Title	Published	Views	Family All 48
ALT Linux	Security fix for the ALT Linux 10 package cri-o version 1.26.2-alt1	29 Mar 202300:00	–	altlinux
BDU FSTEC	The vulnerability of the CRI-O Container Engine’s application programming interface allows a attacker to disclose confidential information or alter arbitrary data.	1 Apr 202400:00	–	bdu_fstec
CBLMariner	CVE-2022-2995 affecting package cri-o for versions less than 1.21.7-2	30 Apr 202401:31	–	cbl_mariner
Circl	CVE-2022-2995	20 Sep 202200:38	–	circl
CNNVD	CRI-O 安全漏洞	25 Aug 202200:00	–	cnnvd
CVE	CVE-2022-2995	19 Sep 202219:53	–	cve
Cvelist	CVE-2022-2995	19 Sep 202219:53	–	cvelist
EUVD	EUVD-2022-6897	3 Oct 202520:07	–	euvd
Github Security Blog	CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure	20 Sep 202200:00	–	github
NVD	CVE-2022-2995	19 Sep 202220:15	–	nvd