Skip to content
OpenAdvisories

Package · Go

github.com/cri-o/cri-o

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.7
    CVE-2025-4437

    Cri-o: large /etc/passwd file may lead to denial of service

    There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is ex…

    Red Hat Red Hat OpenShift Container Platform 4 github.com/cri-o/cri-o Go
  • Medium 6.6
    CVE-2025-0750

    Cri-o: cri-o path traversal in log handling functions allows arbitrary unmounting

    A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of…

    Red Hat Red Hat OpenShift Container Platform 4.18 Red Hat OpenShift Container Platform 4.17 github.com/cri-o/cri-o Go
  • Medium 6.5
    CVE-2023-6476

    Cri-o: pods are able to break out of resource confinement on cgroupv2

    A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of servi…

    Red Hat Red Hat OpenShift Container Platform 4.14 Red Hat OpenShift Container Platform 4.13 Red Hat OpenShift Container Platform 3.11 Go
  • Medium 4.8
    CVE-2022-27652

    Incorrect Default Permissions in CRI-O

    A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw al…

    github.com/cri-o/cri-o Go
  • Medium —
    GHSA-w2j5-3rcx-vx7x

    Sysctls applied to containers with host IPC or host network namespaces can affect the host

    ### Impact Before setting the sysctls for a pod, the pods namespaces must be unshared (created). However, in cases where the pod is using a host network or IPC namespace, a bug in CRI-O caused the namespace creating tool [pinns](https://github.com/cri-o/cri-o…

    github.com/cri-o/cri-o Go
  • Medium 4.2
    CVE-2022-0532

    Incorrect Permission Assignment for Critical Resource in CRI-O

    An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel n…

    github.com/cri-o/cri-o Go