The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o missing the fix for CVE-2022-27652, which was previously fixed in OCP 4.9.41 and 4.10.12 via RHBA-2022:5433 and RHSA-2022:1600. This issue could allow an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. For more details, see https://access.redhat.com/security/cve/CVE-2022-27652.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2022:7398 | Vendor Advisory |
| https://access.redhat.com/security/cve/CVE-2022-3466 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2134063 | Issue Tracking Vendor Advisory |
Configurations
History
20 Sep 2023, 17:19
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://access.redhat.com/errata/RHSA-2022:7398 - Vendor Advisory | |
| References | (MISC) https://access.redhat.com/security/cve/CVE-2022-3466 - Vendor Advisory | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2134063 - Issue Tracking, Vendor Advisory | |
| CPE | cpe:2.3:a:kubernetes:cri-o:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| First Time |
Redhat openshift Container Platform
Redhat Kubernetes Kubernetes cri-o |
|
| CWE | CWE-276 |
15 Sep 2023, 16:20
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-15 14:15
Updated : 2024-02-28 20:33
NVD link : CVE-2022-3466
Mitre link : CVE-2022-3466
CVE.ORG link : CVE-2022-3466
JSON object : View
Products Affected
kubernetes
- cri-o
redhat
- openshift_container_platform
CWE
CWE-276
Incorrect Default Permissions