Cri-o vulnerabilities

2 known vulnerabilities in Cri-o from Kubernetes. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Red Hat OpenShift Container Platform 4.12: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-5154Jun 12, 2024Red HatEPSS 1.24%

  A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.

• 7.8 High severity

  Red Hat OpenShift Container Platform 4.11: Improper Control of Dynamically-Managed Code Resources

  CVE-2022-4318Sep 25, 2023Red Hat

  A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.