Lucene search

Veracode Vulnerability DatabaseVERACODE:35235

HistoryApr 25, 2022 - 8:12 a.m.

Insecure Defaults

2022-04-2508:12:13

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5.3 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

7.0%

JSON

github.com/cri-o/cri-o is vulnerable to insecure defaults. The vulnerability exists because its containers started incorrectly with non-empty inheritable Linux process capabilities, allowing an unprivileged user to gain inheritable file capabilities up to the container’s bounding set.

CPENameOperatorVersion
github.com/cri-o/cri-olev1.23.2
github.com/cri-o/cri-olev1.23.2
cri-oeq1.14.11__6.dev.rhaos4.2.git627b85c.el8
cri-oeq1.16.3__28.dev.rhaos4.3.git9aad8e4.el8
cri-oeq1.21.6__2.rhaos4.8.gitb948fcd.2.el8
cri-oeq1.22.1__7.rhaos4.9.git8ed8e79.el8
cri-oeq1.21.3__9.rhaos4.8.git7415a53.el8
cri-oeq1.18.3__15.rhaos4.5.gitae4ef7b.el8
cri-oeq1.13.12__6.dev.rhaos4.1.git8abaaeb.el8_0
cri-oeq1.21.3__2.rhaos4.8.gitff0b7fe.el8

Name	Operator	Version
github.com/cri-o/cri-o	le	v1.23.2
github.com/cri-o/cri-o	le	v1.23.2
cri-o	eq	1.14.11__6.dev.rhaos4.2.git627b85c.el8
cri-o	eq	1.16.3__28.dev.rhaos4.3.git9aad8e4.el8
cri-o	eq	1.21.6__2.rhaos4.8.gitb948fcd.2.el8
cri-o	eq	1.22.1__7.rhaos4.9.git8ed8e79.el8
cri-o	eq	1.21.3__9.rhaos4.8.git7415a53.el8
cri-o	eq	1.18.3__15.rhaos4.5.gitae4ef7b.el8
cri-o	eq	1.13.12__6.dev.rhaos4.1.git8abaaeb.el8_0
cri-o	eq	1.21.3__2.rhaos4.8.gitff0b7fe.el8

Rows per page:

1-10 of 1891

References

bugzilla.redhat.com/show_bug.cgi?id=2066839

github.com/advisories/GHSA-4hj2-r2pm-3hc6

github.com/cri-o/cri-o/security/advisories/GHSA-4hj2-r2pm-3hc6

5.3 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

7.0%

JSON

Related for VERACODE:35235