CVE-2024-34044

The O-RAN E2T I-Release application contains a NULL pointer dereference vulnerability within the buildPrometheusList function. This issue occurs because the peerInfo variable can be NULL , potentially leading to application instability or a crash. While the specific affected versions are not deta...

CVE-2024-34043

O-RAN RICAPP kpimon-go I-Release has a segmentation violation via a certain E2AP-PDU message...

CVE-2024-34045

The O-RAN E2T I-Release Prometheus metric Increment function can crash in sctpThread.cpp for message.peerInfo-countersININITIMSGCOUNTERProcedureCodeidE2setup-Increment...

CVE-2024-34048

O-RAN RIC I-Release e2mgr lacks array size checks in E2nodeConfigUpdateNotificationHandler...

PT-2024-25665 · O Ran · O-Ran Ric I-Release E2Mgr

Name of the Vulnerable Software and Affected Versions: O-RAN RIC I-Release e2mgr affected versions not specified Description: The issue is related to a lack of array size checks in the E2nodeConfigUpdateNotificationHandler of the O-RAN RIC I-Release e2mgr. No information is provided about the...

CVE-2024-34043

O-RAN RICAPP kpimon-go I-Release has a segmentation violation via a certain E2AP-PDU message...

CVE-2024-34047: Improper Validation of Array Index

O-RAN RIC I-Release e2mgr lacks array size checks in RicServiceUpdateHandler...

CVE-2024-34048: Improper Validation of Array Index

O-RAN RIC I-Release e2mgr lacks array size checks in E2nodeConfigUpdateNotificationHandler...

CVE-2024-34044: NULL Pointer Dereference

The O-RAN E2T I-Release buildPrometheusList function can have a NULL pointer dereference because peerInfo can be NULL...

CVE-2024-34043: Undefined Security Weakness

O-RAN RICAPP kpimon-go I-Release has a segmentation violation via a certain E2AP-PDU message...

CVE-2024-34045

The O-RAN E2T I-Release software contains a vulnerability where the Prometheus metric Increment function can cause a crash. Specifically, the crash occurs within sctpThread.cpp when the Increment() function is invoked for message.peerInfo->counters[IN_INITI][MSG_COUNTER][ProcedureCode_id_E2set...

Oracle Linux 8 : cri-o (ELSA-2024-12348)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12348 advisory. - Address CVE-2024-24786 cri-tools - Address CVE-2024-24786 etcd - Address protobuf CVE-2024-24786 - Address protobuf CVE-2024-24786 - Backport from...

CVE-2024-34048

O-RAN RIC I-Release e2mgr lacks array size checks in E2nodeConfigUpdateNotificationHandler...

Oracle Linux 9 : cri-o (ELSA-2024-12347)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12347 advisory. - Address CVE-2024-24786 cri-tools - Address CVE-2024-24786 etcd - Address protobuf CVE-2024-24786 - Address protobuf CVE-2024-24786 - Backport from...

RHEL 8 : OpenShift Container Platform 4.11.43 (RHSA-2023:3541)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3541 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

RHEL 7 / 8 : OpenShift Container Platform 4.10.60 (RHSA-2023:3216)

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3216 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...

GHSA-C5PJ-MQFH-RVC3 Withdrawn: Runc allows an arbitrary systemd property to be injected

Withdrawn Advisory This advisory has been withdrawn because it was incorrectly attributed to runc. Please see the issue here for more information. Original Description A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a po...

Withdrawn: Runc allows an arbitrary systemd property to be injected

Withdrawn Advisory This advisory has been withdrawn because it was incorrectly attributed to runc. Please see the issue here for more information. Original Description A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a po...

AZL-42307 CVE-2024-3154 affecting package cri-o for versions less than 1.22.3-2

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...

CVE-2024-3154

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...