Skip to content
OpenAdvisories
High · 7.1 CVE-2022-2995 EUVD-2022-6897GHSA-phjr-8j92-w5v7GO-2022-1014

CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure

Published Sep 19, 2022 · Updated May 29, 2025 · Assigned by redhat

Package: cri-o Package: github.com/cri-o/cri-o Ecosystem: Azure Linux Ecosystem: Go

Description

Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

Affected products

VendorProductAffectedFixed
— cri-o cri-o 1.25.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Openshift Ironic 4 crudini 0.9.3-4.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 future 0.18.2-9.el9.1 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-ironic +4 1:21.0.1-0.20221114235951.fe64d5e.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-ironic-inspector +3 11.0.1-0.20221205155952.cd22607.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-ironic-python-agent 9.0.1-0.20220818145522.ad1eb41.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-macros 2020.1.2-1.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 pyOpenSSL +1 20.0.1-2.el9.1 RHSA-2022:7398
Red Hat Openshift Ironic 4 pyflakes 2.2.0-3.el9.1 RHSA-2022:7398
Red Hat Openshift Ironic 4 pysnmp 4.4.12-6.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 python-SecretStorage 2.3.1-9.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 python-alembic 1.6.0-1.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 python-amqp +1 5.0.6-1.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 python-flask +2 1:1.1.2-6.el8 RHSA-2023:3541
Red Hat OpenShift 4 NetworkManager +14 1:1.36.0-8.el8_6 RHSA-2022:7398
Red Hat OpenShift 4 afterburn +1 5.3.0-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 afterburn-dracut 5.3.0-1.rhaos4.12.el9 RHSA-2022:7398
Red Hat OpenShift 4 ansible-runner +1 1.4.6-2.el8ar RHSA-2022:7398
Red Hat OpenShift 4 ansible-runner-http 1.0.0-2.el8ar RHSA-2022:7398
Red Hat OpenShift 4 atomic-openshift-service-idler 4.12.0-202210141624.p0.ga0f9090.assembly.stream.el8 RHSA-2022:7398
Red Hat OpenShift 4 bootupd +1 0.2.5-3.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 buildah +1 1:1.23.4-2.el8 RHSA-2022:7398
Red Hat OpenShift 4 butane +1 0.16.0-2.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 conmon 2:2.1.2-2.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 conmon-rs 0.4.0-2.rhaos4.12.git.el8 RHSA-2022:7398
Red Hat OpenShift 4 console-login-helper-messages +2 0.20.4-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 container-selinux 2:2.188.0-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 containernetworking-plugins 1.0.1-5.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 containers-common 2:1-27.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 coreos-installer +1 0.16.1-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 coreos-installer-dracut 0.16.1-1.rhaos4.12.el9 RHSA-2022:7398
Red Hat OpenShift 4 cri-o 1.23.5-11.rhaos4.10.gitfc32aac.el7 RHSA-2023:3541, RHSA-2023:3216, RHSA-2022:7398
Red Hat OpenShift 4 cri-tools 1.25.0-2.el8 RHSA-2022:7398
Red Hat OpenShift 4 crit +4 3.15-4.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 crudini 0.9-11.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 crun 1.4.2-1.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 fuse-overlayfs 1.9-1.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 grpc +4 1.18.0-4.el8ost RHSA-2022:7398
Red Hat OpenShift 4 haproxy +1 2.2.24-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 ignition +1 2.14.0-5.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 kata-containers 2.5.2-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 kernel-rt +15 4.18.0-372.40.1.rt7.197.el8_6 RHSA-2022:7398
Red Hat OpenShift 4 libslirp +1 4.4.0-2.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 nmstate +4 1.3.3-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 openshift +1 4.12.0-202301042257.p0.g77bec7a.assembly.stream.el8 RHSA-2022:7398
Red Hat OpenShift 4 openshift-ansible +1 4.12.0-202211071957.p0.g3a9d20e.assembly.stream.el8 RHSA-2022:7398
Red Hat OpenShift 4 openshift-clients +1 4.12.0-202301042257.p0.g854f807.assembly.stream.el8 RHSA-2022:7398
Red Hat OpenShift 4 openshift-kuryr +4 4.12.0-202210261235.p0.g92b9be2.assembly.stream.el8 RHSA-2022:7398
Red Hat OpenShift 4 openvswitch2.17 +5 2.17.0-62.el8fdp RHSA-2022:7398
Red Hat OpenShift 4 ostree +3 2022.2-5.el8 RHSA-2022:7398
Red Hat OpenShift 4 ovn22.06 +3 22.06.0-27.el8fdp RHSA-2022:7398
Red Hat OpenShift 4 ovn22.09 +3 22.09.0-25.el8fdp RHSA-2022:7398
Red Hat OpenShift 4 podman +5 2:4.2.0-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 podman-gvproxy 3:4.2.0-4.rhaos4.12.el9 RHSA-2022:7398
Red Hat OpenShift 4 pycdlib-tools +2 1.11.0-3.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-alembic +1 1.4.2-5.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-amqp +2 2.5.2-7.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-cmd2 +1 1.4.0-1.1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-construct +1 2.10.56-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-dogpile-cache +1 1.1.2-1.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-eventlet +1 0.30.2-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-flask +2 1:1.1.1-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-funcsigs +2 1.0.2-8.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-gunicorn +1 19.9.0-10.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-ifaddr +1 0.1.6-5.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-importlib-metadata +1 1.7.0-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-iso8601 +1 0.1.12-8.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-jsonschema +1 3.2.0-5.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-kombu +1 1:4.6.6-7.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-kubernetes +2 25.3.0-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-lockfile +1 1:0.11.0-8.el8ar RHSA-2022:7398
Red Hat OpenShift 4 python-msgpack +1 0.6.2-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-config +1 2:8.7.1-0.20211012155707.1a7bd66.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-context +2 3.3.1-0.20211012152439.641a1e0.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-db +3 9.1.0-0.20211020204148.be2cc6a.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-i18n +2 5.1.0-0.20211012165753.b031d17.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-log +3 4.6.0-0.20211012154701.41c8807.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-messaging +2 12.9.1-0.20211020204149.f9de265.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-metrics +2 0.3.0-0.20211020174122.43eee50.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-policy +3 3.8.2-0.20211012161944.c7fd9f4.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-serialization +2 4.2.0-0.20211012151454.2b94a4f.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-packaging +2 20.4-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-paste +1 3.2.4-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-paste-deploy +1 2.0.1-4.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pexpect +1 4.6-2.el8ar RHSA-2022:7398
Red Hat OpenShift 4 python-pint +1 0.10.1-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyghmi +1 1.5.14-2.1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyperclip +2 1.6.4-6.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyroute2 +1 0.5.13-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyrsistent +1 0.16.0-3.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-requests-unixsocket +1 0.1.5-5.el8ar RHSA-2022:7398
Red Hat OpenShift 4 python-rsa +1 4.7-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-tenacity +1 6.2.0-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-wcwidth +1 0.1.7-14.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-werkzeug +1 1.0.1-3.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-zeroconf +1 0.24.4-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-zipp +1 0.5.1-2.el8ost RHSA-2022:7398
Red Hat OpenShift 4 rpm-ostree +2 2022.10.99.g0049dbdd-3.el8 RHSA-2022:7398
Red Hat OpenShift 4 runc 3:1.1.2-2.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 skopeo +1 2:1.8.0-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 slirp4netns 1.1.8-1.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 tini 0.16.1-1.el8ar RHSA-2022:7398
Red Hat OpenShift 4 toolbox 0.1.0-1.rhaos4.12.el8 RHSA-2022:7398

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) cri-o 1.21.7-2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/cri-o/cri-o < 1.25.0 1.25.0 GHSA-phjr-8j92-w5v7

Advisories 4

References