CVE-2022-4318
Fixed in a distro release EPSS <1%CVSS 7.8
A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.
Products: Red Hat OpenShift Container Platform 4.11, Red Hat OpenShift Container Platform 4.12, Red Hat Enterprise Linux 9
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/cri-o/cri-o | 1.26.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 4.11 | cri-o | 0:1.24.4-10.rhaos4.11.git1ed5ac5.el8 |
| Red Hat openshift 4.11 | cri-o-debuginfo | 0:1.24.4-10.rhaos4.11.git1ed5ac5.el8 |
| Red Hat openshift 4.11 | cri-o-debugsource | 0:1.24.4-10.rhaos4.11.git1ed5ac5.el8 |
| Red Hat openshift 4.12 | cri-o | 0:1.25.2-10.rhaos4.12.git0a083f9.el8 |
| Red Hat openshift 4.12 | cri-o | 0:1.25.2-9.rhaos4.12.git0a083f9.el9 |
| Red Hat openshift 4.12 | cri-o-debuginfo | 0:1.25.2-10.rhaos4.12.git0a083f9.el8 |
| Red Hat openshift 4.12 | cri-o-debuginfo | 0:1.25.2-9.rhaos4.12.git0a083f9.el9 |
| Red Hat openshift 4.12 | cri-o-debugsource | 0:1.25.2-10.rhaos4.12.git0a083f9.el8 |
| Red Hat openshift 4.12 | cri-o-debugsource | 0:1.25.2-9.rhaos4.12.git0a083f9.el9 |