1182 matches found
The vulnerability of the CRI-O Container Engine’s application programming interface, a software platform for managing clusters of virtual machines in Kubernetes, arises from improper elimination of certain elements. This allows an attacker to perform arbitrary actions on the host system.
The vulnerability of the CRI-O Container Engine’s application programming interface, a software platform for managing clusters of virtual machines in Kubernetes, stems from the ability to introduce arbitrary properties through the Pod annotations of systemd. Exploiting this vulnerability allows a...
ROS-20240522-01
A vulnerability in the CRI-O container mechanism is related to the injection of an arbitrary property via the Pod annotation. systemd. Exploitation of the vulnerability could allow an attacker acting remotely to perform an an arbitrary action on the host system...
RHEL 8 / 9 : OpenShift Container Platform 4.12.57 (RHSA-2024:2784)
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2784 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...
AZL-45243 CVE-2024-3727 affecting package cri-o 1.30.1-1
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks...
RHEL 9 : cri-o (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - cri-o: memory exhaustion on the node when access to the kube api CVE-2022-1708 Note that Nessus has not tested for...
RHCOS 4 : OpenShift Container Platform 4.14.24 (RHSA-2024:2672)
The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2672 advisory. - golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-45288 - buildah: full container escape ...
cri-o: Arbitrary command injection via pod annotation
A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...
RHEL 8 / 9 : OpenShift Container Platform 4.15.12 (RHSA-2024:2669)
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2669 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...
RHEL 8 / 9 : OpenShift Container Platform 4.14.24 (RHSA-2024:2672)
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2672 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...
GHSA-2CGQ-H8XW-2V5J CRI-O vulnerable to an arbitrary systemd property injection
Impact On CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation: --- apiVersion: v1 kind: Pod metadata: name: poc-arbitrary-systemd-property-injection annotations: I believe that ExecStart with an arbitrary command works here too, but I haven't figured out how to...
CRI-O vulnerable to an arbitrary systemd property injection
Impact On CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation: --- apiVersion: v1 kind: Pod metadata: name: poc-arbitrary-systemd-property-injection annotations: I believe that ExecStart with an arbitrary command works here too, but I haven't figured out how to...
CVE-2023-44487 affecting package cri-o for versions less than 1.21.7-2
CVE-2023-44487 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...
CVE-2021-44716 affecting package cri-o for versions less than 1.21.7-2
CVE-2021-44716 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...
CVE-2022-27651 affecting package cri-o for versions less than 1.21.7-2
CVE-2022-27651 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...
CVE-2022-21698 affecting package cri-o for versions less than 1.21.7-2
CVE-2022-21698 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...
CVE-2023-42821 affecting package cri-o for versions less than 1.21.7-2
CVE-2023-42821 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...
CVE-2022-2995 affecting package cri-o for versions less than 1.21.7-2
CVE-2022-2995 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...
CVE-2021-3602 affecting package cri-o for versions less than 1.21.7-2
CVE-2021-3602 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...