Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · OpenShift 4 openshift:4.18::el8 | cri-o | 0:1.31.13-14.rhaos4.18.gitf2de9ac.el8 |
| Red Hat · OpenShift 4 openshift:4.18::el8 | cri-o-debuginfo | 0:1.31.13-14.rhaos4.18.gitf2de9ac.el8 |
| Red Hat · OpenShift 4 openshift:4.18::el8 | cri-o-debugsource | 0:1.31.13-14.rhaos4.18.gitf2de9ac.el8 |
| Red Hat · OpenShift 4 openshift:4.18::el9 | cri-o | 0:1.31.13-14.rhaos4.18.gitf2de9ac.el9 |
| Red Hat · OpenShift 4 openshift:4.18::el9 | cri-o-debuginfo | 0:1.31.13-14.rhaos4.18.gitf2de9ac.el9 |
| Red Hat · OpenShift 4 openshift:4.18::el9 | cri-o-debugsource | 0:1.31.13-14.rhaos4.18.gitf2de9ac.el9 |
Vulnerabilities 2
-
High 7.8
Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env
A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. T…
-
High 7.5
Go JOSE affect by a panic in JWE decryption
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2455470
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500846
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66385.json
-
report
https://access.redhat.com/security/cve/CVE-2026-15809
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-15809
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-15809
-
article
https://github.com/cri-o/cri-o/pull/6450
-
article
https://github.com/cri-o/cri-o/pull/6524
-
report
https://access.redhat.com/security/cve/CVE-2026-34986
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-34986
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34986
-
article
https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8
-
article
https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants