Red Hat Security AdvisoryRHSA-2020:1937
OpenShift Container Platform 4.4.3 cri-o security update
Released 2020-05-04 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.4 cri-o-1.17.4-8.dev.rhaos4.4.git5f5c5e4.el7, cri-o-1.17.4-8.dev.rhaos4.4.git5f5c5e4.el8
Fixes 2 records
Priority MEDIUM 41
The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.05071 · Published 2020-02-12 · Partial fix · 0.1.1 CWE-416
Priority LOW 17
A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform.
CVSS 3.1LOW 3.3· Local · No auth · User interaction · EPSS 0.00688 · Published 2021-05-27 · Partial fix CWE-400
