CVE-2023-49569 affecting package cri-o for versions less than 1.30.1-1

CVE-2023-49569 affecting package cri-o for versions less than 1.30.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-21626 affecting package cri-o for versions less than 1.30.1-1

CVE-2024-21626 affecting package cri-o for versions less than 1.30.1-1. An upgraded version of the package is available that resolves this issue...

OPENSUSE-SU-2024:12206-1 cri-o-1.24.1-1.1 on GA media

These are all security issues fixed in the cri-o-1.24.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10699-1 cri-o-1.22.0-1.2 on GA media

These are all security issues fixed in the cri-o-1.22.0-1.2 package on the GA media of openSUSE Tumbleweed...

GO-2024-2919 malicious container creates symlink "mtab" on the host External in github.com/cri-o/cri-o

malicious container creates symlink "mtab" on the host External in github.com/cri-o/cri-o...

CVE-2024-21626 affecting package cri-o for versions less than 1.21.7-3

CVE-2024-21626 affecting package cri-o for versions less than 1.21.7-3. A patched version of the package is available...

CVE-2022-4318 affecting package cri-o for versions less than 1.22.3-1

CVE-2022-4318 affecting package cri-o for versions less than 1.22.3-1. A patched version of the package is available...

CVE-2024-3154 affecting package cri-o for versions less than 1.22.3-2

CVE-2024-3154 affecting package cri-o for versions less than 1.22.3-2. A patched version of the package is available...

CVE-2024-5154

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...

CVE-2024-5154

The CVE-2024-5154 entry concerns a vulnerability in the cri-o component used by Red Hat OpenShift/OpenShift Container Platform where a malicious container can traverse directories (../) to read/write arbitrary host files due to improper symbolic link validation. Affected products include CRI-O wi...

CVE-2024-5154 Cri-o: malicious container can create symlink on host

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...

CVE-2024-5154 Cri-o: malicious container can create symlink on host

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...

cri-o: malicious container can create symlink on host

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...

Path Traversal

github.com/cri-o/cri-o is vulnerable to Path Traversal. The vulnerability is due to the path of the /etc directory being relative to the base of the container, which could lead to a container escape...

cri-o: Arbitrary command injection via pod annotation

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...

RHEL 8 / 9 : OpenShift Container Platform 4.13.43 (RHSA-2024:3496)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:3496 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...

GO-2024-2791 CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o

CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o...

RHEL 8 : cri-o (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull CVE-2020-8945 - The OCI...

PT-2024-4423

Name of the Vulnerable Software and Affected Versions cri-o versions prior to 1.30.1 cri-o versions prior to 1.29.5 cri-o versions prior to 1.28.7 Description A flaw was found in cri-o, allowing a malicious container to create a symbolic link to arbitrary files on the host via directory traversal...

OESA-2024-1688 runc security update

runc is a CLI tool for spawning and running containers according to the OCI specification. Security Fixes: A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary actio...