Database/Container, Kubernetes & orchestration
CRI-O: Crafted environment variable injects arbitrary lines into /etc/passwd
CVSS 7.8CVE-2022-4318Container, Kubernetes & orchestrationcurated
Impact
Crafted environment variable injects arbitrary lines into /etc/passwd
Who can reach it
Malicious image or tenant-controlled pod env
What to do
Upgrade CRI-O; drain node
References
Related entries
- CRI-O: Unbounded ExecSync output exhausts node memory or diskCVE-2022-1708 · CRI-OHigh
- CRI-O: Incorrect supplementary group handling leads to information disclosure between workloadsCVE-2022-2995 · CRI-OHigh
- CRI-O: Containers started with non-empty default inheritable capabilitiesCVE-2022-27652 · CRI-OMedium
- CRI-O: All pod processes share one memory cgroup, so a workload OOM kills conmon and destabilises the nodeCVE-2019-14891 · CRI-OMedium
- CRI-O: Shipped OpenShift CRI-O builds regressed the CVE-2022-2995 fixCVE-2022-3466 · CRI-OMedium
- CRI-O: "Safe" sysctls applied to the host when a pod uses host IPC/networkCVE-2022-0532 · CRI-OMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.