852 matches found
CRI-O Installed (Linux)
Binary data cri-odetect.nbin...
Azure Linux 3.0 Security Update: cri-tools / moby-runc / runc (CVE-2024-45310)
The version of cri-tools / moby-runc / runc installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45310 advisory. - runc is a CLI tool for spawning and running containers according to the OCI...
CVE-2024-44337 affecting package cri-o for versions less than 1.22.3-11
CVE-2024-44337 affecting package cri-o for versions less than 1.22.3-11. A patched version of the package is available...
Linux Distros Unpatched Vulnerability : CVE-2024-8676
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that...
Linux Distros Unpatched Vulnerability : CVE-2024-9676
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-...
Linux Distros Unpatched Vulnerability : CVE-2022-1708
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs...
AZL-57289 CVE-2025-22869 affecting package cri-o 1.30.1-1
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...
AZL-57111 CVE-2025-27144 affecting package cri-o 1.30.1-1
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...
CVE-2023-6476 affecting package cri-o for versions less than 1.22.3-10
CVE-2023-6476 affecting package cri-o for versions less than 1.22.3-10. A patched version of the package is available...
CVE-2023-0778 affecting package cri-o for versions less than 1.22.3-10
CVE-2023-0778 affecting package cri-o for versions less than 1.22.3-10. A patched version of the package is available...
CVE-2024-45310 affecting package cri-tools for versions less than 1.32.0-1
CVE-2024-45310 affecting package cri-tools for versions less than 1.32.0-1. An upgraded version of the package is available that resolves this issue...
Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.17.16 security update
Red Hat OpenShift Container Platform release 4.17.16 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a...
Astra Linux – Vulnerability in libpod
A vulnerability was discovered in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang, resulting in a denial of service through an OOM kill when running a malicious image using an automatically assigned user...
RHEL 8 / 9 : OpenShift Container Platform 4.17.16 (RHSA-2025:1122)
The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:1122 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...
Azure Linux 3.0 Security Update: azcopy / containerized-data-importer / cri-o / golang / moby-engine / prometheus / sriov-network-device-plugin (CVE-2022-41717)
The version of azcopy / containerized-data-importer / cri-o / golang / moby-engine / prometheus / sriov-network-device- plugin installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-41717 advisory. - An...
Azure Linux 3.0 Security Update: application-gateway-kubernetes-ingress / cf-cli / cri-o / csi-driver-lvm / golang / keda / moby-engine / node-problem-detector (CVE-2021-44716)
The version of application-gateway-kubernetes-ingress / cf-cli / cri-o / csi-driver-lvm / golang / keda / moby-engine / node-problem-detector installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-44716...
Azure Linux 3.0 Security Update: cert-manager / containerized-data-importer / cri-o / dcos-cli / keda / kubernetes (CVE-2024-28180)
The version of cert-manager / containerized-data-importer / cri-o / dcos-cli / keda / kubernetes installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-28180 advisory. - Package jose aims to provide an...
Azure Linux 3.0 Security Update: containerized-data-importer / cri-o / ig / libcontainers-common / skopeo (CVE-2024-3727)
The version of containerized-data-importer / cri-o / ig / libcontainers-common / skopeo installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-3727 advisory. - A flaw was found in the...
Path Traversal
github.com/cri-o/cri-o is vulnerable to Path Traversal. The vulnerability is due to improper handling of file paths in the log management functions UnMountPodLogs and LinkContainerLogs, it allows an attacker to manipulate the paths, potentially unmounting arbitrary host paths...