CVE-2024-5154
Fixed in a distro release EPSS 1%CVSS 8.1
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.
Products: Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 3.11
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/cri-o/cri-o | 1.28.7 |
| Go | github.com/cri-o/cri-o | 1.29.5 |
| Go | github.com/cri-o/cri-o | 1.30.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 4.12 | cri-o | 0:1.25.5-21.2.rhaos4.12.gita3eb75f.el8 |
| Red Hat openshift 4.12 | cri-o-debuginfo | 0:1.25.5-21.2.rhaos4.12.gita3eb75f.el8 |
| Red Hat openshift 4.12 | cri-o-debugsource | 0:1.25.5-21.2.rhaos4.12.gita3eb75f.el8 |
| Red Hat openshift 4.13 | cri-o | 0:1.26.5-18.2.rhaos4.13.git2e90133.el9 |
| Red Hat openshift 4.13 | cri-o | 0:1.26.5-18.2.rhaos4.13.git2e90133.el8 |
| Red Hat openshift 4.13 | cri-o-debuginfo | 0:1.26.5-18.2.rhaos4.13.git2e90133.el8 |
| Red Hat openshift 4.13 | cri-o-debuginfo | 0:1.26.5-18.2.rhaos4.13.git2e90133.el9 |
| Red Hat openshift 4.13 | cri-o-debugsource | 0:1.26.5-18.2.rhaos4.13.git2e90133.el9 |
| Red Hat openshift 4.13 | cri-o-debugsource | 0:1.26.5-18.2.rhaos4.13.git2e90133.el8 |
| Red Hat openshift 4.14 | cri-o | 0:1.27.7-3.rhaos4.14.git674563e.el8 |
| Red Hat openshift 4.14 | cri-o | 0:1.27.7-3.rhaos4.14.git674563e.el9 |
| Red Hat openshift 4.14 | cri-o-debuginfo | 0:1.27.7-3.rhaos4.14.git674563e.el9 |
| Red Hat openshift 4.14 | cri-o-debuginfo | 0:1.27.7-3.rhaos4.14.git674563e.el8 |
| Red Hat openshift 4.14 | cri-o-debugsource | 0:1.27.7-3.rhaos4.14.git674563e.el9 |
| Red Hat openshift 4.14 | cri-o-debugsource | 0:1.27.7-3.rhaos4.14.git674563e.el8 |
| Red Hat openshift 4.15 | cri-o | 0:1.28.7-2.rhaos4.15.git111aec5.el9 |
| Red Hat openshift 4.15 | cri-o | 0:1.28.7-2.rhaos4.15.git111aec5.el8 |
| Red Hat openshift 4.15 | cri-o-debuginfo | 0:1.28.7-2.rhaos4.15.git111aec5.el9 |
| Red Hat openshift 4.15 | cri-o-debuginfo | 0:1.28.7-2.rhaos4.15.git111aec5.el8 |
| Red Hat openshift 4.15 | cri-o-debugsource | 0:1.28.7-2.rhaos4.15.git111aec5.el8 |
| Red Hat openshift 4.15 | cri-o-debugsource | 0:1.28.7-2.rhaos4.15.git111aec5.el9 |
| Red Hat openshift 4.16 | bpftool | 0:7.3.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | bpftool-debuginfo | 0:7.3.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | cri-o | 0:1.29.5-7.rhaos4.16.git7db4ada.el8 |
| Red Hat openshift 4.16 | cri-o | 0:1.29.5-7.rhaos4.16.git7db4ada.el9 |
| Red Hat openshift 4.16 | cri-o-debuginfo | 0:1.29.5-7.rhaos4.16.git7db4ada.el9 |
| Red Hat openshift 4.16 | cri-o-debuginfo | 0:1.29.5-7.rhaos4.16.git7db4ada.el8 |
| Red Hat openshift 4.16 | cri-o-debugsource | 0:1.29.5-7.rhaos4.16.git7db4ada.el9 |
| Red Hat openshift 4.16 | cri-o-debugsource | 0:1.29.5-7.rhaos4.16.git7db4ada.el8 |
| Red Hat openshift 4.16 | kernel | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-core | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-debug | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-debug-core | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-debug-debuginfo | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-debug-devel | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-debug-devel-matched | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-debug-modules | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-debug-modules-core | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-debug-modules-extra | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-debug-modules-internal | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-debug-modules-partner | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-debuginfo | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-devel | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-devel-matched | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-modules | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-modules-core | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-modules-extra | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-modules-internal | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-64k-modules-partner | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-abi-stablelists | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-core | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debug | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debug-core | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debug-debuginfo | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debug-devel | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debug-devel-matched | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debug-modules | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debug-modules-core | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debug-modules-extra | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debug-modules-internal | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debug-modules-partner | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debug-uki-virt | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debuginfo | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debuginfo-common-aarch64 | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debuginfo-common-ppc64le | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debuginfo-common-s390x | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-debuginfo-common-x86_64 | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-devel | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-devel-matched | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-doc | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-ipaclones-internal | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-modules | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-modules-core | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-modules-extra | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-modules-internal | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-modules-partner | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-core | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-debug | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-debug-core | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-debug-debuginfo | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-debug-devel | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-debug-devel-matched | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-debug-kvm | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-debug-modules | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-debug-modules-core | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-debug-modules-extra | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-debug-modules-internal | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-debug-modules-partner | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-debuginfo | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-devel | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-devel-matched | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-kvm | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-modules | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-modules-core | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-modules-extra | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-modules-internal | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-rt-modules-partner | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-selftests-internal | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-tools | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-tools-debuginfo | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-tools-libs | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-tools-libs-devel | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-uki-virt | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-zfcpdump | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-zfcpdump-core | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-zfcpdump-debuginfo | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-zfcpdump-devel | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-zfcpdump-devel-matched | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-zfcpdump-modules | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-zfcpdump-modules-core | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-zfcpdump-modules-extra | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-zfcpdump-modules-internal | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | kernel-zfcpdump-modules-partner | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | libperf-debuginfo | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | openshift | 0:4.16.0-202406191607.p0.g58452d8.assembly.stream.el9 |
| Red Hat openshift 4.16 | openshift | 0:4.16.0-202406191607.p0.g58452d8.assembly.stream.el8 |
| Red Hat openshift 4.16 | openshift-hyperkube | 0:4.16.0-202406191607.p0.g58452d8.assembly.stream.el9 |
| Red Hat openshift 4.16 | openshift-hyperkube | 0:4.16.0-202406191607.p0.g58452d8.assembly.stream.el8 |
| Red Hat openshift 4.16 | openshift-kube-apiserver | 0:4.16.0-202406191607.p0.g58452d8.assembly.stream.el9 |
| Red Hat openshift 4.16 | openshift-kube-apiserver | 0:4.16.0-202406191607.p0.g58452d8.assembly.stream.el8 |
| Red Hat openshift 4.16 | openshift-kube-controller-manager | 0:4.16.0-202406191607.p0.g58452d8.assembly.stream.el9 |
| Red Hat openshift 4.16 | openshift-kube-controller-manager | 0:4.16.0-202406191607.p0.g58452d8.assembly.stream.el8 |
| Red Hat openshift 4.16 | openshift-kube-scheduler | 0:4.16.0-202406191607.p0.g58452d8.assembly.stream.el8 |
| Red Hat openshift 4.16 | openshift-kube-scheduler | 0:4.16.0-202406191607.p0.g58452d8.assembly.stream.el9 |
| Red Hat openshift 4.16 | openshift-kubelet | 0:4.16.0-202406191607.p0.g58452d8.assembly.stream.el9 |
| Red Hat openshift 4.16 | openshift-kubelet | 0:4.16.0-202406191607.p0.g58452d8.assembly.stream.el8 |
| Red Hat openshift 4.16 | perf | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | perf-debuginfo | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | python3-perf | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | python3-perf-debuginfo | 0:5.14.0-427.24.1.el9_4 |
| Red Hat openshift 4.16 | rtla | 0:5.14.0-427.24.1.el9_4 |