Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-3466

The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o missing the fix for CVE-2022-27652, which was previously fixed in OCP 4.9.41 and 4.10.12 via RHBA-2022:5433 and RHSA-2022:1600. This issue could allow an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. For more details, see https://access.redhat.com/security/cve/CVE-2022-27652.

Published

2023-09-15T14:15:08.037

Last Modified

2024-11-21T07:19:35.063

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.8 (MEDIUM)

Weaknesses

Type: Secondary
CWE-276
Type: Primary
CWE-276

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	kubernetes	cri-o	-	Yes
Application	redhat	openshift_container_platform	3.11	Yes
Application	redhat	openshift_container_platform	4.12	Yes

References

https://access.redhat.com/errata/RHSA-2022:7398 Vendor Advisory ([email protected])
https://access.redhat.com/security/cve/CVE-2022-3466 Vendor Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=2134063 Issue Tracking, Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2022:7398 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/security/cve/CVE-2022-3466 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=2134063 Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)