CVE-2024-5154CWE-22path-traversal

CVE-2024-5154

High · published June 12, 2024

CVSS v3.1
8.1
EPSS
1%
Percentile
68.9
In the wild
Unconfirmed
What it is

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01237 · 68.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-06-12T13:15Z
Affected products (9)
ProductVersionsFixed in
kubernetes/cri-oall versions—
kubernetes/cri-oall versions—
kubernetes/cri-oall versions—
redhat/openshift_container_platformall versions—
redhat/openshift_container_platformall versions—
redhat/openshift_container_platformall versions—
redhat/openshift_container_platformall versions—
redhat/openshift_container_platformall versions—
redhat/openshift_container_platformall versions—
References (16)
https://access.redhat.com/security/cve/CVE-2024-5154 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2280190 · [email protected]https://access.redhat.com/errata/RHSA-2024:3700 · [email protected]https://access.redhat.com/errata/RHSA-2024:4008 · [email protected]https://access.redhat.com/errata/RHSA-2024:4159 · [email protected]https://access.redhat.com/errata/RHSA-2024:4486 · [email protected]https://access.redhat.com/errata/RHSA-2024:10818 · [email protected]https://access.redhat.com/errata/RHSA-2024:3676 · [email protected]https://github.com/cri-o/cri-o/security/advisories/GHSA-j9hf-98c3-wrm8 · [email protected]https://access.redhat.com/errata/RHSA-2024:3676 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:3700 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:4008 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:4486 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/security/cve/CVE-2024-5154 · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=2280190 · af854a3a-2127-422b-91ae-364da2661108https://github.com/cri-o/cri-o/security/advisories/GHSA-j9hf-98c3-wrm8 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 12 JUN 08:51Z
    Cri-o: malicious container can create symlink on host
    cvelistv5