Description
A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.11 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | cri-o | 1.24.4-10.rhaos4.11.git1ed5ac5.el8 | RHSA-2023:1503, RHSA-2023:1033 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | cri-o | 1.26.2-r0 | — |
| Alpine v3.23 | cri-o | 1.26.2-r0 | — |
| Alpine v3.22 | cri-o | 1.26.2-r0 | — |
| Alpine v3.21 | cri-o | 1.26.2-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | cri-o | 1.22.3-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/cri-o/cri-o | < 1.26.0 | 1.26.0 | GHSA-cm9x-c3rh-7rc4 |
Advisories 3
- WID-SEC-2023-0600 Red Hat OpenShift: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Oct 1, 2026
- RHSA-2023:1503 Red Hat Security Advisory: OpenShift Container Platform 4.11.34 packages and security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- RHSA-2023:1033 Red Hat Security Advisory: OpenShift Container Platform 4.12.6 packages and security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
References
- RHSA-2023:1033 vendor-advisory
- RHSA-2023:1503 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2022-4318 vdb-entry
- RHBZ#2152703 issue-tracking