CVE-2022-4318 affecting package cri-o for versions less than 1.22.3-1

CVE-2022-4318 affecting package cri-o for versions less than 1.22.3-1. A patched version of the package is available...

CVE-2023-45142 affecting package cri-tools for versions less than 1.29.0-2

CVE-2023-45142 affecting package cri-tools for versions less than 1.29.0-2. An upgraded version of the package is available that resolves this issue...

CVE-2024-3154 affecting package cri-o for versions less than 1.22.3-2

CVE-2024-3154 affecting package cri-o for versions less than 1.22.3-2. A patched version of the package is available...

CVE-2023-45288 affecting package cri-tools for versions less than 1.29.0-2

CVE-2023-45288 affecting package cri-tools for versions less than 1.29.0-2. A patched version of the package is available...

CVE-2024-5154

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...

CVE-2024-5154

The CVE-2024-5154 entry concerns a vulnerability in the cri-o component used by Red Hat OpenShift/OpenShift Container Platform where a malicious container can traverse directories (../) to read/write arbitrary host files due to improper symbolic link validation. Affected products include CRI-O wi...

CVE-2024-5154 Cri-o: malicious container can create symlink on host

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...

CVE-2024-5154 Cri-o: malicious container can create symlink on host

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...

Amazon Linux 2 : cri-tools (ALAS-2024-2568)

The version of cri-tools installed on the remote host is prior to 1.29.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2568 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of...

Medium: cri-tools

Issue Overview: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed...

cri-o: malicious container can create symlink on host

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...

Path Traversal

github.com/cri-o/cri-o is vulnerable to Path Traversal. The vulnerability is due to the path of the /etc directory being relative to the base of the container, which could lead to a container escape...

cri-o: Arbitrary command injection via pod annotation

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...

RHEL 8 / 9 : OpenShift Container Platform 4.13.43 (RHSA-2024:3496)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:3496 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...

GO-2024-2791 CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o

CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o...

RHEL 8 : cri-o (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull CVE-2020-8945 - The OCI...

PT-2024-4423

Name of the Vulnerable Software and Affected Versions cri-o versions prior to 1.30.1 cri-o versions prior to 1.29.5 cri-o versions prior to 1.28.7 Description A flaw was found in cri-o, allowing a malicious container to create a symbolic link to arbitrary files on the host via directory traversal...

OESA-2024-1688 runc security update

runc is a CLI tool for spawning and running containers according to the OCI specification. Security Fixes: A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary actio...

Cri-o: arbitrary command injection via pod annotation

...

The vulnerability of the CRI-O Container Engine’s application programming interface, a software platform for managing clusters of virtual machines in Kubernetes, arises from improper elimination of certain elements. This allows an attacker to perform arbitrary actions on the host system.

The vulnerability of the CRI-O Container Engine’s application programming interface, a software platform for managing clusters of virtual machines in Kubernetes, stems from the ability to introduce arbitrary properties through the Pod annotations of systemd. Exploiting this vulnerability allows a...