CVE-2024-3154
Fixed in a distro release EPSS 1%CVSS 7.2
A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.
Products: Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 3.11
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/cri-o/cri-o | 1.29.4 |
| Go | github.com/cri-o/cri-o | 1.28.6 |
| Go | github.com/cri-o/cri-o | 1.27.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | buildah | 1.35.3-r1 |
| Chainguard | cadvisor | 0.52.1-r3 |
| Chainguard | cadvisor-compat | 0.52.1-r3 |
| Chainguard | cadvisor-fips | 0.49.1-r5 |
| Chainguard | ctop | 0.7.7-r23 |
| Chainguard | grype | 0.90.0-r1 |
| Chainguard | ingress-nginx-controller-compat-fips-1.9 | 1.9.6-r1 |
| Chainguard | ingress-nginx-controller-fips-1.9 | 1.9.6-r1 |
| Chainguard | kube-apiserver-1.28 | 1.28.15-r11 |
| Chainguard | kube-apiserver-1.28-default | 1.28.15-r11 |
| Chainguard | kube-apiserver-fips-1.28 | 1.28.15-r9 |
| Chainguard | kube-apiserver-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kube-apiserver-fips-1.29 | 1.29.15-r2 |
| Chainguard | kube-apiserver-fips-1.29-default | 1.29.15-r2 |
| Chainguard | kube-controller-manager-1.28 | 1.28.15-r11 |
| Chainguard | kube-controller-manager-1.28-default | 1.28.15-r11 |
| Chainguard | kube-controller-manager-fips-1.28 | 1.28.15-r9 |
| Chainguard | kube-controller-manager-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kube-controller-manager-fips-1.29 | 1.29.15-r2 |
| Chainguard | kube-controller-manager-fips-1.29-default | 1.29.15-r2 |
| Chainguard | kube-proxy-1.28 | 1.28.15-r11 |
| Chainguard | kube-proxy-1.28-default | 1.28.15-r11 |
| Chainguard | kube-proxy-1.28-default-compat | 1.28.15-r11 |
| Chainguard | kube-proxy-fips-1.28 | 1.28.15-r9 |
| Chainguard | kube-proxy-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kube-proxy-fips-1.29 | 1.29.15-r2 |
| Chainguard | kube-proxy-fips-1.29-default | 1.29.15-r2 |
| Chainguard | kube-scheduler-1.28 | 1.28.15-r11 |
| Chainguard | kube-scheduler-1.28-default | 1.28.15-r11 |
| Chainguard | kube-scheduler-fips-1.28 | 1.28.15-r9 |
| Chainguard | kube-scheduler-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kube-scheduler-fips-1.29 | 1.29.15-r2 |
| Chainguard | kube-scheduler-fips-1.29-default | 1.29.15-r2 |
| Chainguard | kube-webhook-certgen-fips-1.9 | 1.9.6-r1 |
| Chainguard | kubeadm-1.28 | 1.28.15-r11 |
| Chainguard | kubeadm-1.28-default | 1.28.15-r11 |
| Chainguard | kubeadm-fips-1.28 | 1.28.15-r9 |
| Chainguard | kubeadm-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kubeadm-fips-1.29 | 1.29.15-r2 |
| Chainguard | kubeadm-fips-1.29-default | 1.29.15-r2 |
| Chainguard | kubectl-1.27 | no fix |
| Chainguard | kubectl-1.27-default | no fix |
| Chainguard | kubectl-1.27-default | 1.27.11-r1 |
| Chainguard | kubectl-1.28 | 1.28.15-r11 |
| Chainguard | kubectl-1.28-bitnami-compat | 1.28.15-r11 |
| Chainguard | kubectl-1.28-default | 1.28.15-r11 |
| Chainguard | kubectl-1.29 | no fix |
| Chainguard | kubectl-1.29-default | no fix |
| Chainguard | kubectl-bash-completion-1.27 | no fix |
| Chainguard | kubectl-bash-completion-1.28 | 1.28.15-r11 |
| Chainguard | kubectl-bash-completion-1.29 | no fix |
| Chainguard | kubectl-bash-completion-fips-1.28 | 1.28.15-r9 |
| Chainguard | kubectl-bash-completion-fips-1.29 | 1.29.15-r2 |
| Chainguard | kubectl-fips-1.28 | 1.28.15-r9 |
| Chainguard | kubectl-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kubectl-fips-1.29 | 1.29.15-r2 |
| Chainguard | kubectl-fips-1.29-default | 1.29.15-r2 |
| Chainguard | kubelet-1.28 | 1.28.15-r11 |
| Chainguard | kubelet-1.28-default | 1.28.15-r11 |
| Chainguard | kubelet-fips-1.28 | 1.28.15-r9 |
| Chainguard | kubelet-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kubelet-fips-1.29 | 1.29.15-r2 |
| Chainguard | kubelet-fips-1.29-default | 1.29.15-r2 |
| Chainguard | kubernetes-1.28 | 1.28.15-r11 |
| Chainguard | kubernetes-1.28-default | 1.28.15-r11 |
| Chainguard | kubernetes-fips-1.28 | 1.28.15-r9 |
| Chainguard | kubernetes-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kubernetes-fips-1.29 | 1.29.15-r2 |
| Chainguard | kubernetes-fips-1.29-default | 1.29.15-r2 |
| Chainguard | kubernetes-pause-1.28 | 1.28.15-r11 |
| Chainguard | kubernetes-pause-compat-1.28 | 1.28.15-r11 |
| Chainguard | kubernetes-pause-fips-3.9 | 1.28.15-r9 |
| Chainguard | neuvector-scanner | 0_git20240528-r10 |
| Chainguard | neuvector-scanner-monitor | 0_git20240528-r10 |
| Chainguard | neuvector-scanner-task | 0_git20240528-r10 |
| Chainguard | newrelic-infrastructure-agent-1.43 | 1.43.2-r9 |
| Chainguard | opentelemetry-collector-contrib | 0.122.0-r1 |
| Chainguard | opentelemetry-collector-contrib-compat | 0.122.0-r1 |
| Chainguard | opentelemetry-collector-contrib-fips | 0.99.0-r1 |
| Chainguard | wolfictl | 0.16.6-r1 |
| Red Hat openshift 4.12 | cri-o | 0:1.25.5-16.2.rhaos4.12.gitcb09013.el8 |
| Red Hat openshift 4.12 | cri-o-debuginfo | 0:1.25.5-16.2.rhaos4.12.gitcb09013.el8 |
| Red Hat openshift 4.12 | cri-o-debugsource | 0:1.25.5-16.2.rhaos4.12.gitcb09013.el8 |
| Red Hat openshift 4.12 | podman | 3:4.4.1-3.2.rhaos4.12.el8 |
| Red Hat openshift 4.12 | podman-catatonit | 3:4.4.1-3.2.rhaos4.12.el8 |
| Red Hat openshift 4.12 | podman-catatonit-debuginfo | 3:4.4.1-3.2.rhaos4.12.el8 |
| Red Hat openshift 4.12 | podman-debuginfo | 3:4.4.1-3.2.rhaos4.12.el8 |
| Red Hat openshift 4.12 | podman-debugsource | 3:4.4.1-3.2.rhaos4.12.el8 |
| Red Hat openshift 4.12 | podman-docker | 3:4.4.1-3.2.rhaos4.12.el8 |
| Red Hat openshift 4.12 | podman-gvproxy | 3:4.4.1-3.2.rhaos4.12.el8 |
| Red Hat openshift 4.12 | podman-gvproxy-debuginfo | 3:4.4.1-3.2.rhaos4.12.el8 |
| Red Hat openshift 4.12 | podman-plugins | 3:4.4.1-3.2.rhaos4.12.el8 |
| Red Hat openshift 4.12 | podman-plugins-debuginfo | 3:4.4.1-3.2.rhaos4.12.el8 |
| Red Hat openshift 4.12 | podman-remote | 3:4.4.1-3.2.rhaos4.12.el8 |
| Red Hat openshift 4.12 | podman-remote-debuginfo | 3:4.4.1-3.2.rhaos4.12.el8 |
| Red Hat openshift 4.12 | podman-tests | 3:4.4.1-3.2.rhaos4.12.el8 |
| Red Hat openshift 4.12 | skopeo | 2:1.9.4-4.3.rhaos4.12.el8 |
| Red Hat openshift 4.12 | skopeo | 2:1.9.4-4.3.rhaos4.12.el9 |
| Red Hat openshift 4.12 | skopeo-debuginfo | 2:1.9.4-4.3.rhaos4.12.el9 |
| Red Hat openshift 4.12 | skopeo-debuginfo | 2:1.9.4-4.3.rhaos4.12.el8 |
| Red Hat openshift 4.12 | skopeo-debugsource | 2:1.9.4-4.3.rhaos4.12.el8 |
| Red Hat openshift 4.12 | skopeo-debugsource | 2:1.9.4-4.3.rhaos4.12.el9 |
| Red Hat openshift 4.12 | skopeo-tests | 2:1.9.4-4.3.rhaos4.12.el9 |
| Red Hat openshift 4.12 | skopeo-tests | 2:1.9.4-4.3.rhaos4.12.el8 |
| Red Hat openshift 4.13 | cri-o | 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el8 |
| Red Hat openshift 4.13 | cri-o | 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9 |
| Red Hat openshift 4.13 | cri-o-debuginfo | 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el8 |
| Red Hat openshift 4.13 | cri-o-debuginfo | 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9 |
| Red Hat openshift 4.13 | cri-o-debugsource | 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el8 |
| Red Hat openshift 4.13 | cri-o-debugsource | 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9 |
| Red Hat openshift 4.14 | cri-o | 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el8 |
| Red Hat openshift 4.14 | cri-o | 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9 |
| Red Hat openshift 4.14 | cri-o-debuginfo | 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el8 |
| Red Hat openshift 4.14 | cri-o-debuginfo | 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9 |
| Red Hat openshift 4.14 | cri-o-debugsource | 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el8 |
| Red Hat openshift 4.14 | cri-o-debugsource | 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9 |
| Red Hat openshift 4.14 | openshift | 0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el9 |
| Red Hat openshift 4.14 | openshift | 0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el8 |
| Red Hat openshift 4.14 | openshift-hyperkube | 0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el8 |
| Red Hat openshift 4.14 | openshift-hyperkube | 0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el9 |
| Red Hat openshift 4.14 | podman | 3:4.4.1-13.4.rhaos4.14.el9 |
| Red Hat openshift 4.14 | podman | 3:4.4.1-13.4.rhaos4.14.el8 |
| Red Hat openshift 4.14 | podman-catatonit | 3:4.4.1-13.4.rhaos4.14.el8 |
| Red Hat openshift 4.14 | podman-catatonit-debuginfo | 3:4.4.1-13.4.rhaos4.14.el8 |
| Red Hat openshift 4.14 | podman-debuginfo | 3:4.4.1-13.4.rhaos4.14.el9 |
| Red Hat openshift 4.14 | podman-debuginfo | 3:4.4.1-13.4.rhaos4.14.el8 |
| Red Hat openshift 4.14 | podman-debugsource | 3:4.4.1-13.4.rhaos4.14.el8 |
| Red Hat openshift 4.14 | podman-debugsource | 3:4.4.1-13.4.rhaos4.14.el9 |
| Red Hat openshift 4.14 | podman-docker | 3:4.4.1-13.4.rhaos4.14.el8 |
| Red Hat openshift 4.14 | podman-docker | 3:4.4.1-13.4.rhaos4.14.el9 |
| Red Hat openshift 4.14 | podman-gvproxy | 3:4.4.1-13.4.rhaos4.14.el8 |
| Red Hat openshift 4.14 | podman-gvproxy | 3:4.4.1-13.4.rhaos4.14.el9 |
| Red Hat openshift 4.14 | podman-gvproxy-debuginfo | 3:4.4.1-13.4.rhaos4.14.el8 |
| Red Hat openshift 4.14 | podman-gvproxy-debuginfo | 3:4.4.1-13.4.rhaos4.14.el9 |
| Red Hat openshift 4.14 | podman-plugins | 3:4.4.1-13.4.rhaos4.14.el8 |
| Red Hat openshift 4.14 | podman-plugins | 3:4.4.1-13.4.rhaos4.14.el9 |
| Red Hat openshift 4.14 | podman-plugins-debuginfo | 3:4.4.1-13.4.rhaos4.14.el9 |
| Red Hat openshift 4.14 | podman-plugins-debuginfo | 3:4.4.1-13.4.rhaos4.14.el8 |
| Red Hat openshift 4.14 | podman-remote | 3:4.4.1-13.4.rhaos4.14.el9 |
| Red Hat openshift 4.14 | podman-remote | 3:4.4.1-13.4.rhaos4.14.el8 |
| Red Hat openshift 4.14 | podman-remote-debuginfo | 3:4.4.1-13.4.rhaos4.14.el9 |
| Red Hat openshift 4.14 | podman-remote-debuginfo | 3:4.4.1-13.4.rhaos4.14.el8 |
| Red Hat openshift 4.14 | podman-tests | 3:4.4.1-13.4.rhaos4.14.el8 |
| Red Hat openshift 4.14 | podman-tests | 3:4.4.1-13.4.rhaos4.14.el9 |
| Red Hat openshift 4.15 | cri-o | 0:1.28.6-2.rhaos4.15.git77bbb1c.el9 |
| Red Hat openshift 4.15 | cri-o | 0:1.28.6-2.rhaos4.15.git77bbb1c.el8 |
| Red Hat openshift 4.15 | cri-o-debuginfo | 0:1.28.6-2.rhaos4.15.git77bbb1c.el9 |
| Red Hat openshift 4.15 | cri-o-debuginfo | 0:1.28.6-2.rhaos4.15.git77bbb1c.el8 |
| Red Hat openshift 4.15 | cri-o-debugsource | 0:1.28.6-2.rhaos4.15.git77bbb1c.el9 |
| Red Hat openshift 4.15 | cri-o-debugsource | 0:1.28.6-2.rhaos4.15.git77bbb1c.el8 |
| Red Hat openshift 4.15 | podman | 3:4.4.1-23.2.rhaos4.15.el8 |
| Red Hat openshift 4.15 | podman | 3:4.4.1-23.2.rhaos4.15.el9 |
| Red Hat openshift 4.15 | podman-catatonit | 3:4.4.1-23.2.rhaos4.15.el8 |
| Red Hat openshift 4.15 | podman-catatonit-debuginfo | 3:4.4.1-23.2.rhaos4.15.el8 |
| Red Hat openshift 4.15 | podman-debuginfo | 3:4.4.1-23.2.rhaos4.15.el8 |
| Red Hat openshift 4.15 | podman-debuginfo | 3:4.4.1-23.2.rhaos4.15.el9 |
| Red Hat openshift 4.15 | podman-debugsource | 3:4.4.1-23.2.rhaos4.15.el9 |
| Red Hat openshift 4.15 | podman-debugsource | 3:4.4.1-23.2.rhaos4.15.el8 |
| Red Hat openshift 4.15 | podman-docker | 3:4.4.1-23.2.rhaos4.15.el8 |
| Red Hat openshift 4.15 | podman-docker | 3:4.4.1-23.2.rhaos4.15.el9 |
| Red Hat openshift 4.15 | podman-gvproxy | 3:4.4.1-23.2.rhaos4.15.el9 |
| Red Hat openshift 4.15 | podman-gvproxy | 3:4.4.1-23.2.rhaos4.15.el8 |
| Red Hat openshift 4.15 | podman-gvproxy-debuginfo | 3:4.4.1-23.2.rhaos4.15.el9 |
| Red Hat openshift 4.15 | podman-gvproxy-debuginfo | 3:4.4.1-23.2.rhaos4.15.el8 |
| Red Hat openshift 4.15 | podman-plugins | 3:4.4.1-23.2.rhaos4.15.el9 |
| Red Hat openshift 4.15 | podman-plugins | 3:4.4.1-23.2.rhaos4.15.el8 |
| Red Hat openshift 4.15 | podman-plugins-debuginfo | 3:4.4.1-23.2.rhaos4.15.el9 |
| Red Hat openshift 4.15 | podman-plugins-debuginfo | 3:4.4.1-23.2.rhaos4.15.el8 |
| Red Hat openshift 4.15 | podman-remote | 3:4.4.1-23.2.rhaos4.15.el8 |
| Red Hat openshift 4.15 | podman-remote | 3:4.4.1-23.2.rhaos4.15.el9 |
| Red Hat openshift 4.15 | podman-remote-debuginfo | 3:4.4.1-23.2.rhaos4.15.el8 |
| Red Hat openshift 4.15 | podman-remote-debuginfo | 3:4.4.1-23.2.rhaos4.15.el9 |
| Red Hat openshift 4.15 | podman-tests | 3:4.4.1-23.2.rhaos4.15.el8 |
| Red Hat openshift 4.15 | podman-tests | 3:4.4.1-23.2.rhaos4.15.el9 |
| Wolfi | buildah | 1.35.3-r1 |
| Wolfi | cadvisor | 0.52.1-r3 |
| Wolfi | cadvisor-compat | 0.52.1-r3 |
| Wolfi | ctop | 0.7.7-r23 |
| Wolfi | grype | 0.90.0-r1 |
| Wolfi | kube-apiserver-1.28 | 1.28.15-r11 |
| Wolfi | kube-apiserver-1.28-default | 1.28.15-r11 |
| Wolfi | kube-controller-manager-1.28 | 1.28.15-r11 |
| Wolfi | kube-controller-manager-1.28-default | 1.28.15-r11 |
| Wolfi | kube-proxy-1.28 | 1.28.15-r11 |
| Wolfi | kube-proxy-1.28-default | 1.28.15-r11 |
| Wolfi | kube-scheduler-1.28 | 1.28.15-r11 |
| Wolfi | kube-scheduler-1.28-default | 1.28.15-r11 |
| Wolfi | kubeadm-1.28 | 1.28.15-r11 |
| Wolfi | kubeadm-1.28-default | 1.28.15-r11 |
| Wolfi | kubectl-1.27 | no fix |
| Wolfi | kubectl-1.27-default | 1.27.11-r1 |
| Wolfi | kubectl-1.27-default | no fix |
| Wolfi | kubectl-1.28 | 1.28.15-r11 |
| Wolfi | kubectl-1.28-default | 1.28.15-r11 |
| Wolfi | kubectl-1.29 | no fix |
| Wolfi | kubectl-1.29-default | no fix |
| Wolfi | kubectl-bash-completion-1.27 | no fix |
| Wolfi | kubectl-bash-completion-1.28 | 1.28.15-r11 |
| Wolfi | kubectl-bash-completion-1.29 | no fix |
| Wolfi | kubelet-1.28 | 1.28.15-r11 |
| Wolfi | kubelet-1.28-default | 1.28.15-r11 |
| Wolfi | kubernetes-1.28 | 1.28.15-r11 |
| Wolfi | kubernetes-1.28-default | 1.28.15-r11 |
| Wolfi | neuvector-scanner | 0_git20240528-r10 |
| Wolfi | neuvector-scanner-monitor | 0_git20240528-r10 |
| Wolfi | neuvector-scanner-task | 0_git20240528-r10 |
| Wolfi | opentelemetry-collector-contrib | 0.122.0-r1 |
| Wolfi | opentelemetry-collector-contrib-compat | 0.122.0-r1 |
| Wolfi | wolfictl | 0.16.6-r1 |
| openSUSE Tumbleweed | grype | 0.80.1-1.1 |