Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

10 records

Vendor: Kubernetes Component: Cri-o Clear all filters
TI-2022-03955 CVE-2022-4318 · GHSA-cm9x-c3rh-7rc4

Cri-o: /etc/passwd tampering privesc

Priority LOW 36

A vulnerability was found in cri-o.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0029 Published 2023-09-25 Fixed in 1.24.4-10.rhaos4.11.git1ed5ac5.el8, 1.25.2-9.rhaos4.12.git0a083f9.el9 +1 CWE-538
TI-2022-03201 CVE-2022-3466 · GHSA-3wr5-8397-gqc8

Cri-o: security regression of cve-2022-27652

Priority LOW 23

The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o missing t…

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00212 Published 2023-09-15 Partial fix · 1.25.1-5.rhaos4.12.git6005903.el9 CWE-276
TI-2022-02765 CVE-2022-2995 · GHSA-phjr-8j92-w5v7

Improper access control in cri-o

Priority HIGH 66

Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where s…

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00386 Published 2022-09-19 Partial fix · 1.25.0 CWE-284
TI-2022-01574 CVE-2022-1708 · GHSA-fcm2-6c3h-pg6j

Uncontrolled resource consumption in CRI-O

Priority LOW 39

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03165 Published 2022-06-07 Partial fix · 1.24.1, 1.23.3 +1 CWE-400
TI-2022-10633 CVE-2022-27652 · GHSA-4hj2-r2pm-3hc6

Incorrect default permissions in cri-o

Priority LOW 24

A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions.

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00245 Published 2022-04-18 Partial fix · 1.24.0 CWE-276
TI-2022-00719 CVE-2022-0811 · GHSA-6x2m-w449-qwx7

Code injection in CRI-O

Priority MEDIUM 56

A flaw was found in CRI-O in the way it set kernel options for a pod.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.19046 Published 2022-03-16 Fixed in 1.19.6, 1.20.7 +3 CWE-94
TI-2022-00452 CVE-2022-0532 · GHSA-jqmc-79gx-7g8p

Incorrect permission assignment in cri-o

Priority LOW 21

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier.

CVSS 3.1MEDIUM 4.2 Network Low privileges No interaction EPSS 0.00765 Published 2022-02-09 Partial fix · 1.23.1 CWE-732
TI-2019-11095 CVE-2019-14891 · GHSA-7hwv-gxwq-2g5p

Improper check for unusual conditions in cri-o

Priority LOW 24

A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00796 Published 2019-11-25 Fixed CWE-460
TI-2018-15874 CVE-2018-1000400 · GHSA-339v-9xv2-qg2w

Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error…

Priority MEDIUM 42

Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.0197 Published 2018-05-18 Fixed CWE-269