7.2
High
CVE-2024-3154 A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation
Description
A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Container Platform 4.12 | Versions not published | |
| Red Hat OpenShift Container Platform 4.13 | Versions not published | |
| Red Hat OpenShift Container Platform 4.14 | Versions not published | |
| Red Hat OpenShift Container Platform 4.15 | Versions not published | |
| Red Hat OpenShift Container Platform 3.11 | Versions not published |
References
- RHSA-2024:2669 access.redhat.com
- RHSA-2024:2672 access.redhat.com
- RHSA-2024:2784 access.redhat.com
- RHSA-2024:3496 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2272532 bugzilla.redhat.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat OpenShift Container Platform 4.12
The 113 CVEs of Red Hat OpenShift Container Platform 4.12 →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Medium
CVE-2026-75888
A flaw was found in the OpenShift console
7.7
High
CVE-2026-93017
The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core…
7.7
High
CVE-2026-83589
A flaw was found in oauth-proxy
6.1
Medium