852 matches found
Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a CRI-O security vulnerability (CVE-2022-0532)
Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability in CRI-O that could allow a remote authenticated attacker to bypass security restrictions, caused by improper sysctls validation. Vulnerability Details CVEID: CVE-2022-0532 Description: CRI-O could allow a remote...
Supplementary groups are not set up properly in github.com/containerd/containerd
Impact A bug was found in containerd where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in...
GHSA-HMFX-3PCX-653P Supplementary groups are not set up properly in github.com/containerd/containerd
Impact A bug was found in containerd where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in...
Rocky Linux 8 : container-tools:rhel8 (RLSA-2022:7457)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7457 advisory. - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 whe...
SUSE CVE-2022-3466
The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o missing the fix for CVE-2022-27652, which was previously fixed in OCP 4.9.41 and 4.10....
SUSE CVE-2022-4318
A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable...
SUSE CVE-2022-27652
A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby Docker Engine where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs...
Privilege Escalation
cri-o is vulnerable to Privilege Escalation. The vulnerability allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve2 runs...
Amazon Linux 2022 : containerd, containerd-stress (ALAS2022-2022-210)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-210 advisory. A bug was found in containerd where containers launched through containerd's CRI implementation with a specially-crafted image configuration could gain access to read-only copies of arbitrary...
RHEL 8 : OpenShift Container Platform 4.11.5 (RHSA-2022:6535)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:6535 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud...
cri-o: Security regression of CVE-2022-27652
The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o missing the fix for CVE-2022-27652, which was previously fixed in OCP 4.9.41 and 4.10....
Privilege Escalation
github.com/cri-o/cri-o is vulnerable to Privilege Escalation. The vulnerability exists because the setupContainerUser function in containercreate.go does not properly validate the homedir parameter, allowing an attacker to maliciously craft an environment variable with newlines to add entries to ...
SUSE SLES15 / openSUSE 15 Security Update : conmon (SUSE-SU-2022:4635-1)
The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:4635-1 advisory. conmon was updated to version 2.1.5: don't leak syslogidentifier logging: do not read more that the buf size logging: fix erro...
CRI-O vulnerable to /etc/passwd tampering resulting in Privilege Escalation
Impact It is possible to craft an environment variable with newlines to add entries to a container's /etc/passwd. It is possible to circumvent admission validation of username/UID by adding such an entry. Note: because the pod author is in control of the container's /etc/passwd, this is not...
GHSA-CM9X-C3RH-7RC4 CRI-O vulnerable to /etc/passwd tampering resulting in Privilege Escalation
Impact It is possible to craft an environment variable with newlines to add entries to a container's /etc/passwd. It is possible to circumvent admission validation of username/UID by adding such an entry. Note: because the pod author is in control of the container's /etc/passwd, this is not...
SUSE SLES15 / openSUSE 15 Security Update : conmon (SUSE-SU-2022:4607-1)
The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:4607-1 advisory. conmon was updated to version 2.1.5: don't leak syslogidentifier logging: do not read more that the buf size logging: fix erro...
PT-2022-7296 · Cri-O +2 · Cri-O +2
Name of the Vulnerable Software and Affected Versions: cri-o versions prior to 1.26.0 Description: A vulnerability was found in cri-o, allowing the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable. This issue may allow an attacker to impact the...
ROS-20221223-01
The containerd container runtime vulnerability is related to a bug in the CRI containerd thread server when handling terminal resize events. Exploitation of the vulnerability could allow an attacker, acting remotely, to query the TTY and cause it to crash by sending an invalid command and running...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : containerd (SUSE-SU-2022:4463-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4463-1 advisory. Update to containerd v1.6.12 including Docker v20.10.21-ce bsc1206065. Also includes the followi...
