The vulnerability of the CRI-O Container Engine’s application programming interface, a software platform for managing clusters of virtual machines in Kubernetes, relates to the distribution of resources without any restrictions or controls. This allows a malicious actor to trigger service failures.

The vulnerability of the CRI-O Container Engine’s application programming interface, a software platform for managing clusters of virtual machines in Kubernetes, is related to an experimental exploit that allows containers to become unlimited in size. Exploiting this vulnerability could enable a...

ROS-20240402-02

A vulnerability in the CRI-O container mechanism is related to experimental annotation, causing the the container becomes unrestricted. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

...

ROS-20240401-03

A vulnerability in the CRI-O container mechanism is related to adding arbitrary lines to /etc/passwd using a a specially crafted environment variable. Exploitation of the vulnerability could allow an attacker acting remotely to affect the confidentiality, integrity, and availability of the CRI-O...

The vulnerability of the CRI-O Container Engine’s application programming interface allows a attacker to disclose confidential information or alter arbitrary data.

The vulnerability of the CRI-O Container Engine’s application programming interface, a software platform for managing clusters of virtual machines in Kubernetes, is related to improper access control. Exploiting this vulnerability can allow an attacker to disclose confidential information or alte...

OESA-2024-1335 cri-o security update

Open Container Initiative-based implementation of Kubernetes Container Runtime Interface. Security Fixes: A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.CVE-2022-41723...

ROS-20240329-10

Vulnerability of http2 package of Go programming language is related to uncontrolled server resources consumption as a result of resetting Server.MaxConcurrentStreams parameter during request stream processing. as a result of resetting the Server.MaxConcurrentStreams parameter when processing a...

conmon security update

conmon 2.1.3-8 - address CVE-2023-39326 cri-o 1.26.4-1 - Added Oracle Specific Files for cri-o - Cherry-picked upstream commits for OCPBUGS-17150: oci: simplify stopping code https://github.com/cri-o/cri-o/pull/7185 - Fixed CVE-2023-39325: bump golang.org/x/net to v0.17.0 cri-tools 1.26.1-4 -...

conmon security update

conmon 2.1.3-8 - address CVE-2023-39326 cri-o 1.26.4-1 - Added Oracle Specific Files for cri-o - Cherry-picked upstream commits for OCPBUGS-17150: oci: simplify stopping code https://github.com/cri-o/cri-o/pull/7185 - Fixed CVE-2023-39325: bump golang.org/x/net to v0.17.0 cri-tools 1.26.1-4 -...

AZL-39600 CVE-2024-28180 affecting package cri-o for versions less than 1.21.7-2

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

AZL-35640 CVE-2024-24786 affecting package cri-tools for versions less than 1.30.1-1

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

AZL-35561 CVE-2024-24786 affecting package cri-tools for versions less than 1.29.0-5

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

conmon security update

conmon 2.1.3-8 - address CVE-2023-39326 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build 2.1.3.3 - Add OL9 support 2.1.3.2 - Update inline with Linux team building...

conmon security update

conmon 2.1.3-8 - address CVE-2023-39326 cri-o 1.25.5-1 - Added Oracle Specifile Files for cri-o cri-tools 1.25.0-3 - Resolve CVE-2023-39326 flannel-cni-plugin 1.0.1-4 - Resolve CVE-2023-39326 helm 3.11.1-3 - address CVE-2023-39326 istio 1.16.7-3 - Updated Golang to 1.20.12 to address CVE...

CBL Mariner 2.0 Security Update: cri-tools / kubernetes / kubevirt / moby-runc (CVE-2024-21626M)

The version of cri-tools / kubernetes / kubevirt / moby-runc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-21626M advisory. - NIST NVD Details CVE-2024-21626 Note that Nessus has not tested for...

CVE-2024-21626 affecting package cri-tools for versions less than 1.28.0-5

CVE-2024-21626 affecting package cri-tools for versions less than 1.28.0-5. A patched version of the package is available...

Security Bulletin: IBM Cloud Pak for Data Scheduling is vulnerable to multiple ansible-operator and opm vulnerabilities

Summary Ansible-operator and opm is used by IBM Cloud Pak for Data Scheduling as part of the Ansible operator used for installation of the Scheduler. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2022-23471 DESCRIPTION: containerd is...

CBL Mariner 2.0 Security Update: cri-tools / kubernetes (CVE-2024-21626)

The version of cri-tools / kubernetes installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-21626 advisory. - runc is a CLI tool for spawning and running containers on Linux according to the OCI...

Amazon Linux 2 : cri-tools (ALAS-2024-2446)

The version of cri-tools installed on the remote host is prior to 1.29.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2446 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read ma...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: tekton-chains, nerdctl, kots, docker-credential-gcr, eksctl, cosign-fips, cadvisor, up, cosign, falcoctl-fips, gitsign, newrelic-infrastructure-agent, ko-fips, flux, zarf, k3s, helm-fips, helm-operator-fips, skaffold, buildkitd, pulumi, cadvisor-fips, timoni, kubevel...