923 matches found
CVE-2024-21626 affecting package cri-o for versions less than 1.30.1-1
CVE-2024-21626 affecting package cri-o for versions less than 1.30.1-1. An upgraded version of the package is available that resolves this issue...
OPENSUSE-SU-2024:12206-1 cri-o-1.24.1-1.1 on GA media
These are all security issues fixed in the cri-o-1.24.1-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:10699-1 cri-o-1.22.0-1.2 on GA media
These are all security issues fixed in the cri-o-1.22.0-1.2 package on the GA media of openSUSE Tumbleweed...
GO-2024-2919 malicious container creates symlink "mtab" on the host External in github.com/cri-o/cri-o
malicious container creates symlink "mtab" on the host External in github.com/cri-o/cri-o...
CVE-2024-21626 affecting package cri-o for versions less than 1.21.7-3
CVE-2024-21626 affecting package cri-o for versions less than 1.21.7-3. A patched version of the package is available...
CVE-2024-3154 affecting package cri-o for versions less than 1.22.3-2
CVE-2024-3154 affecting package cri-o for versions less than 1.22.3-2. A patched version of the package is available...
CVE-2022-4318 affecting package cri-o for versions less than 1.22.3-1
CVE-2022-4318 affecting package cri-o for versions less than 1.22.3-1. A patched version of the package is available...
CVE-2023-45142 affecting package cri-tools for versions less than 1.29.0-2
CVE-2023-45142 affecting package cri-tools for versions less than 1.29.0-2. An upgraded version of the package is available that resolves this issue...
CVE-2023-45288 affecting package cri-tools for versions less than 1.29.0-2
CVE-2023-45288 affecting package cri-tools for versions less than 1.29.0-2. A patched version of the package is available...
CVE-2024-5154
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...
CVE-2024-5154
The CVE-2024-5154 entry concerns a vulnerability in the cri-o component used by Red Hat OpenShift/OpenShift Container Platform where a malicious container can traverse directories (../) to read/write arbitrary host files due to improper symbolic link validation. Affected products include CRI-O wi...
CVE-2024-5154 Cri-o: malicious container can create symlink on host
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...
CVE-2024-5154 Cri-o: malicious container can create symlink on host
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...
Medium: cri-tools
Issue Overview: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed...
Amazon Linux 2 : cri-tools (ALAS-2024-2568)
The version of cri-tools installed on the remote host is prior to 1.29.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2568 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of...
cri-o: malicious container can create symlink on host
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...
Path Traversal
github.com/cri-o/cri-o is vulnerable to Path Traversal. The vulnerability is due to the path of the /etc directory being relative to the base of the container, which could lead to a container escape...
cri-o: Arbitrary command injection via pod annotation
A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...
RHEL 8 / 9 : OpenShift Container Platform 4.13.43 (RHSA-2024:3496)
The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:3496 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...