- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 12 · 5 high, 3 medium
- Registry
- pkg.go.dev
Advisories 12
- CVE-2025-4437Medium 5.7
Cri-o: large /etc/passwd file may lead to denial of service
Affected: through 1.33.3; all versions.
- CVE-2025-0750Medium 6.6
Cri-o: cri-o path traversal in log handling functions allows arbitrary unmounting
Affected: through 1.33.0; all versions.
- CVE-2024-8676High 7.4
Cri-o: checkpoint restore can be triggered from different namespaces
Affected: fixed in 1.29.11; from 1.30.0, fixed in 1.30.8; from 1.31.0, fixed in 1.31.3; fixed in 1.29.11; from 1.30.0, fixed in 1.30.8; from 1.31.0, fixed in 1.31.3.
- CVE-2024-5154High 8.1
Cri-o: malicious container can create symlink on host
Affected: from 1.28.6, fixed in 1.28.7; from 1.29.4, fixed in 1.29.5; from 1.30.0, fixed in 1.30.1; from 1.28.6, fixed in 1.28.7; from 1.29.4, fixed in 1.29.5; from 1.30.0, fixed in 1.30.1.
- CVE-2024-3154High 7.2
Cri-o: arbitrary command injection via pod annotation
Affected: fixed in 1.27.6; from 1.28.0, fixed in 1.28.6; from 1.29.0, fixed in 1.29.4; from 1.29.0, fixed in 1.29.4; from 1.28.0, fixed in 1.28.6; fixed in 1.27.6.
- CVE-2023-6476Medium 6.5
Cri-o: pods are able to break out of resource confinement on cgroupv2
Affected: fixed in 1.27.3; from 1.28.0, fixed in 1.28.3; from 1.29.0, fixed in 1.29.1; from 1.29.0, fixed in 1.29.1; from 1.28.0, fixed in 1.28.3; fixed in 1.27.3.
- CVE-2022-4318High 7.8
Cri-o: /etc/passwd tampering privesc
Affected: fixed in 1.26.0.
- CVE-2022-2995High 7.1
Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible…
Affected: fixed in 1.25.0.
- CVE-2022-1708Unrated
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API.
Affected: fixed in 1.22.5; from 1.23.0, fixed in 1.23.3; from 1.24.0, fixed in 1.24.1; from 1.24.0, fixed in 1.24.1; from 1.23.0, fixed in 1.23.3; fixed in 1.22.5.
- CVE-2022-27652Unrated
A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions.
Affected: fixed in 1.24.0.
- CVE-2022-0811Unrated
A flaw was found in CRI-O in the way it set kernel options for a pod.
Affected: from 1.19.0, fixed in 1.19.6; from 1.20.0, fixed in 1.20.7; from 1.21.0, fixed in 1.21.6; from 1.22.0, fixed in 1.22.3; from 1.23.0, fixed in 1.23.2; from 1.19.0, fixed in 1.19.6; from 1.20.0, fixed in 1.20.7; from 1.21.0, fixed in 1.21.6; from 1.22.0, fixed in 1.22.3; from 1.23.0, fixed in 1.23.2.
- CVE-2022-0532Unrated
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier.
Affected: fixed in 1.23.1.