Yüksek CVSS 8.1
CVE-2024-5154: Cri-o: dizin geçişi
Açıklama (NVD)
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.
Özet bilgiler
- Ürün
- Kubernetes Cri-o
- CVSS v3.1
- 8.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - EPSS
- %1,24 (yüzdelik 69)
- CWE
- CWE-22
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| kubernetes-cri-o | 1.28.6 | 1.28.6 | — |
| kubernetes-cri-o | 1.29.4 | 1.29.4 | — |
| kubernetes-cri-o | 1.30.0 | 1.30.0 | — |
| redhat-openshift-container-platform | 3.11 | 3.11 | — |
| redhat-openshift-container-platform | 4.0 | 4.0 | — |
| redhat-openshift-container-platform | 4.12 | 4.12 | — |
| redhat-openshift-container-platform | 4.13 | 4.13 | — |
| redhat-openshift-container-platform | 4.14 | 4.14 | — |
| redhat-openshift-container-platform | 4.15 | 4.15 | — |