RHCOS 4 : OpenShift Container Platform 4.19.45 (RHSA-2026:60452)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:60452 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 -...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.45 packages and security update

Red Hat OpenShift Container Platform release 4.19.45 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a...

CVE-2025-0401

CVE-2025-0401 - Local Privilege Escalation via SUID Binary Abuse Summary CVE-2025-0401 is a local privilege escalation vulnerability discovered in systems where the /usr/bin/passwd binary is misconfigured, allowing unintended root-level access when combined with specific syscall sequences. This...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.31 packages and security update

Red Hat OpenShift Container Platform release 4.21.31 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.36 packages and security update

Red Hat OpenShift Container Platform release 4.20.36 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

RHCOS 4 : OpenShift Container Platform 4.20.36 (RHSA-2026:60444)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:60444 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 -...

RHCOS 4 : OpenShift Container Platform 4.21.31 (RHSA-2026:60449)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:60449 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 -...

Red Hat Libuser Race Condition Vulnerability

Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.11 packages and security update

Red Hat OpenShift Container Platform release 4.22.11 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

RHCOS 4 : OpenShift Container Platform 4.22.11 (RHSA-2026:57361)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57361 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 - golang: Go os.Root:...

CVE-2026-41451

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

CVE-2026-41451 UAC < 3.3.0 Command Injection via User Substitution in parse_artifact.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

CVE-2026-41451 UAC < 3.3.0 Command Injection via User Substitution in parse_artifact.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

CVE-2026-41451

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse_artifact.sh . Usernames and home directories read from /etc/passwd are substituted directly into command strings without escaping before execution via ...

CVE-2026-41451 UAC < 3.3.0 Command Injection via User Substitution in parse_artifact.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

EUVD-2026-64011

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...