GHSA-2CGQ-H8XW-2V5J CRI-O vulnerable to an arbitrary systemd property injection

Impact On CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation: --- apiVersion: v1 kind: Pod metadata: name: poc-arbitrary-systemd-property-injection annotations: I believe that ExecStart with an arbitrary command works here too, but I haven't figured out how to...

CRI-O vulnerable to an arbitrary systemd property injection

Impact On CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation: --- apiVersion: v1 kind: Pod metadata: name: poc-arbitrary-systemd-property-injection annotations: I believe that ExecStart with an arbitrary command works here too, but I haven't figured out how to...

CVE-2024-28180 affecting package cri-o for versions less than 1.21.7-2

CVE-2024-28180 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2021-44716 affecting package cri-o for versions less than 1.21.7-2

CVE-2021-44716 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2022-29526 affecting package cri-o for versions less than 1.21.7-2

CVE-2022-29526 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2022-21698 affecting package cri-o for versions less than 1.21.7-2

CVE-2022-21698 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2022-2995 affecting package cri-o for versions less than 1.21.7-2

CVE-2022-2995 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2023-44487 affecting package cri-o for versions less than 1.21.7-2

CVE-2023-44487 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2022-27651 affecting package cri-o for versions less than 1.21.7-2

CVE-2022-27651 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2021-3602 affecting package cri-o for versions less than 1.21.7-2

CVE-2021-3602 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2023-42821 affecting package cri-o for versions less than 1.21.7-2

CVE-2023-42821 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

Oracle Linux 8 : cri-o (ELSA-2024-12348)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12348 advisory. - Address CVE-2024-24786 cri-tools - Address CVE-2024-24786 etcd - Address protobuf CVE-2024-24786 - Address protobuf CVE-2024-24786 - Backport from...

Oracle Linux 9 : cri-o (ELSA-2024-12347)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12347 advisory. - Address CVE-2024-24786 cri-tools - Address CVE-2024-24786 etcd - Address protobuf CVE-2024-24786 - Address protobuf CVE-2024-24786 - Backport from...

RHEL 7 / 8 : OpenShift Container Platform 4.10.60 (RHSA-2023:3216)

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3216 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...

RHEL 8 : OpenShift Container Platform 4.11.43 (RHSA-2023:3541)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3541 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

GHSA-C5PJ-MQFH-RVC3 Withdrawn: Runc allows an arbitrary systemd property to be injected

Withdrawn Advisory This advisory has been withdrawn because it was incorrectly attributed to runc. Please see the issue here for more information. Original Description A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a po...

Withdrawn: Runc allows an arbitrary systemd property to be injected

Withdrawn Advisory This advisory has been withdrawn because it was incorrectly attributed to runc. Please see the issue here for more information. Original Description A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a po...

AZL-42307 CVE-2024-3154 affecting package cri-o for versions less than 1.22.3-2

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...

CVE-2024-3154

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...

CVE-2024-3154

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...