CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:NCVE-2024-5154
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- kubernetes:cri-o
- redhat:openshift_container_platform
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j9hf-98c3-wrm8 | Go | github.com/cri-o/cri-o | >=1.28.6 <1.28.7 | 1.28.7 |
| GHSA-j9hf-98c3-wrm8 | Go | github.com/cri-o/cri-o | >=1.29.4 <1.29.5 | 1.29.5 |
| GHSA-j9hf-98c3-wrm8 | Go | github.com/cri-o/cri-o | >=1.30.0 <1.30.1 | 1.30.1 |
| GO-2024-2919 | Go | github.com/cri-o/cri-o | >=1.28.6 <1.28.7 >=1.29.4 <1.29.5 >=1.30.0 <1.30.1 | 1.28.7, 1.29.5, 1.30.1 |