EUVD-2022-5937

Malicious code in bioql PyPI...

CVE-2025-22872 affecting package cri-tools for versions less than 1.29.0-8

CVE-2025-22872 affecting package cri-tools for versions less than 1.29.0-8. A patched version of the package is available...

Fedora 44 : cri-o1.34 (2025-2498892c57)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2498892c57 advisory. Automatic update for cri-o1.34-1.34.1-1.fc44. Changelog Thu Oct 2 2025 Bradley G Smith - 1.34.1-1 - Update to release v1.34.1 - Resolves: rhbz233335...

Fedora 44 : cri-o1.31 (2025-01f444b2ce)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-01f444b2ce advisory. Automatic update for cri-o1.31-1.31.13-1.fc44. Changelog Thu Oct 2 2025 Bradley G Smith - 1.31.13-1 - Update to release v1.31.13 - Resolves:...

Fedora 44 : cri-o1.33 (2025-7bc36fec81)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-7bc36fec81 advisory. Automatic update for cri-o1.33-1.33.5-1.fc44. Changelog Thu Oct 2 2025 Bradley G Smith - 1.33.5-1 - Update to release v1.33.5 - Resolves: rhbz233335...

Fedora 44 : cri-o1.32 (2025-852b61fe59)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-852b61fe59 advisory. Automatic update for cri-o1.32-1.32.9-1.fc44. Changelog Thu Oct 2 2025 Bradley G Smith - 1.32.9-1 - Update to release 1.32.9 - Resolves: rhbz2333357...

NewStart CGSL MAIN 6.06 : neod Multiple Vulnerabilities (NS-SA-2025-0234)

The remote NewStart CGSL host, running version MAIN 6.06, has neod packages installed that are affected by multiple vulnerabilities: - containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root...

CVE-2025-22872 affecting package cri-tools for versions less than 1.32.0-2

CVE-2025-22872 affecting package cri-tools for versions less than 1.32.0-2. A patched version of the package is available...

Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

...

GO-2025-3897 CRI-O has Potential High Memory Consumption from File Read in github.com/cri-o/cri-o

CRI-O has Potential High Memory Consumption from File Read in github.com/cri-o/cri-o...

AZL-66728 CVE-2025-58058 affecting package cri-o 1.30.1-1

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current...

CVE-2025-4437

There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a hi...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: cluster-api-aws-controller, cert-manager-csi-driver, kubecolor, nvidia-nsight-compute-13.2, supercronic, volume-modifier-for-k8s, kubernetes-dns-node-cache, dive, cluster-autoscaler-fips, lazygit, hcloud, descheduler-fips, gitness, cert-manager-fips, grafana, mods,...

Gold Melody IAB Exploits Exposed ASP.NET Machine Keys for Unauthorized Access to Targets

The Initial Access Broker IAB known as Gold Melody has been attributed to a campaign that exploits leaked ASP.NET machine keys to obtain unauthorized access to organizations and peddle that access to other threat actors. The activity is being tracked by Palo Alto Networks Unit 42 under the monike...

Allocation of Resources Without Limits or Throttling

Overview github.com/cri-o/cri-o/server is an OCI-based implementation of Kubernetes Container Runtime Interface Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the handling of the /etc/passwd file. An attacker with minimal privileges to...

TencentOS Server 4: cri-o (TSSA-2025:0033)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0033 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Important: cri-tools

Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 The net/http package accepted data in the chunked transfer encoding...

Important: cri-tools

Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 The net/http package accepted data in the chunked transfer encoding...

Amazon Linux 2 : cri-tools (ALAS-2025-2870)

The version of cri-tools installed on the remote host is prior to 1.32.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2870 advisory. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning...

SUSE CVE-2025-47291

containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to version 2.0.5, doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not...