Amazon Linux 2 : cri-tools (ALAS-2024-2446)

The version of cri-tools installed on the remote host is prior to 1.29.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2446 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read ma...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: docker-credential-gcr, flux-helm-controller, goreleaser, vexctl, flux, zot, loki, helm-fips, bom, cadvisor, timoni, scorecard, falcoctl-fips, kpt, k3s, kubescape, policy-controller, flux-image-reflector-controller, kubevela, argo-workflows, up, helm, helm-operator,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: docker-credential-gcr, flux-helm-controller, goreleaser, vexctl, flux, zot, loki, helm-fips, bom, cadvisor, timoni, scorecard, falcoctl-fips, kpt, k3s, kubescape, policy-controller, flux-image-reflector-controller, kubevela, argo-workflows, up, helm, helm-operator,...

containerd environment variable leak

Impact Containers launched through containerd's CRI implementation through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service that share the same image may receive incorrect environment variables, including values that are defined for other containers. If t...

AZL-34642 CVE-2024-21626 affecting package cri-tools for versions less than 1.30.1-1

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process from runc exec to have a working directory in the host filesystem...

AZL-39606 CVE-2024-21626 affecting package cri-o for versions less than 1.21.7-3

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process from runc exec to have a working directory in the host filesystem...

AZL-34060 CVE-2024-21626 affecting package cri-tools for versions less than 1.28.0-5

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process from runc exec to have a working directory in the host filesystem...

GLSA-202401-31 : containerd: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202401-31 containerd: Multiple Vulnerabilities - containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Uni...

RHCOS 4 : OpenShift Container Platform 4.14.9 (RHSA-2024:0207)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0207 advisory. - cri-o: Pods are able to break out of resource confinement on cgroupv2 CVE-2023-6476 - opentelemetry-go-contrib: DoS vulnerability ...

RHCOS 4 : OpenShift Container Platform 4.12.6 (RHSA-2023:1033)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:1033 advisory. - cri-o: /etc/passwd tampering privesc CVE-2022-4318 Note that Nessus has not tested for this issue but has instead relied only on the...

RHCOS 4 : OpenShift Container Platform 4.11.34 (RHSA-2023:1503)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:1503 advisory. - cri-o: /etc/passwd tampering privesc CVE-2022-4318 Note that Nessus has not tested for this issue but has instead relied only on the...

RHCOS 4 : OpenShift Container Platform 4.13.29 (RHSA-2024:0195)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0195 advisory. - cri-o: Pods are able to break out of resource confinement on cgroupv2 CVE-2023-6476 Note that Nessus has not tested for this issue but has...

RHCOS 4 : OpenShift Container Platform 4.10.60 (RHSA-2023:3216)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3216 advisory. - cri-o: incorrect handling of the supplementary groups CVE-2022-2995 Note that Nessus has not tested for this issue but has instead relied...

RHEL 8 / 9 : OpenShift Container Platform 4.13.29 (RHSA-2024:0195)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0195 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...

RHEL 8 / 9 : OpenShift Container Platform 4.14.9 (RHSA-2024:0207)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0207 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.13.29 packages and security update

An update for containernetworking-plugins, cri-o, kernel, kernel-rt, and openshift is now available for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

EulerOS 2.0 SP8 : docker-engine (EulerOS-SA-2023-3118)

According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1,...

AZL-39595 CVE-2023-49568 affecting package cri-o for versions less than 1.22.3-12

A denial of service DoS vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using on...

Improper Access Control

CRI-O is vulnerable to Improper Access Control. The vulnerability is due to improper restrictions of the experimental io.kubernetes.cri-o.UnifiedCgroup annotation, which results in container resources being unconfined. This issue can be exploited by an attacker to specify any amount of memory/cpu...

GHSA-P4RX-7WVG-FWRC CRI-O's pods can break out of resource confinement on cgroupv2

Impact What kind of vulnerability is it? Who is impacted? All versions of CRI-O running on cgroupv2 nodes. Unchecked access to an experimental annotation allows a container to be unconfined. Back in 2021, support was added to support an experimental annotation that allows a user to request specia...