ROS-20240522-01

A vulnerability in the CRI-O container mechanism is related to the injection of an arbitrary property via the Pod annotation. systemd. Exploitation of the vulnerability could allow an attacker acting remotely to perform an an arbitrary action on the host system...

RHEL 8 / 9 : OpenShift Container Platform 4.12.57 (RHSA-2024:2784)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2784 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

AZL-45243 CVE-2024-3727 affecting package cri-o 1.30.1-1

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks...

RHEL 9 : cri-o (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - cri-o: memory exhaustion on the node when access to the kube api CVE-2022-1708 Note that Nessus has not tested for...

RHCOS 4 : OpenShift Container Platform 4.14.24 (RHSA-2024:2672)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2672 advisory. - golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-45288 - buildah: full container escape ...

cri-o: Arbitrary command injection via pod annotation

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...

RHEL 8 / 9 : OpenShift Container Platform 4.15.12 (RHSA-2024:2669)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2669 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

RHEL 8 / 9 : OpenShift Container Platform 4.14.24 (RHSA-2024:2672)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2672 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

GHSA-2CGQ-H8XW-2V5J CRI-O vulnerable to an arbitrary systemd property injection

Impact On CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation: --- apiVersion: v1 kind: Pod metadata: name: poc-arbitrary-systemd-property-injection annotations: I believe that ExecStart with an arbitrary command works here too, but I haven't figured out how to...

CRI-O vulnerable to an arbitrary systemd property injection

Impact On CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation: --- apiVersion: v1 kind: Pod metadata: name: poc-arbitrary-systemd-property-injection annotations: I believe that ExecStart with an arbitrary command works here too, but I haven't figured out how to...

CVE-2024-28180 affecting package cri-o for versions less than 1.21.7-2

CVE-2024-28180 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2022-21698 affecting package cri-o for versions less than 1.21.7-2

CVE-2022-21698 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2021-44716 affecting package cri-o for versions less than 1.21.7-2

CVE-2021-44716 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2022-29526 affecting package cri-o for versions less than 1.21.7-2

CVE-2022-29526 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2023-42821 affecting package cri-o for versions less than 1.21.7-2

CVE-2023-42821 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2022-2995 affecting package cri-o for versions less than 1.21.7-2

CVE-2022-2995 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2022-27651 affecting package cri-o for versions less than 1.21.7-2

CVE-2022-27651 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2021-3602 affecting package cri-o for versions less than 1.21.7-2

CVE-2021-3602 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2023-44487 affecting package cri-o for versions less than 1.21.7-2

CVE-2023-44487 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

Oracle Linux 9 : cri-o (ELSA-2024-12347)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12347 advisory. - Address CVE-2024-24786 cri-tools - Address CVE-2024-24786 etcd - Address protobuf CVE-2024-24786 - Address protobuf CVE-2024-24786 - Backport from...