https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 04:51:29 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-04112 bdu:2024-04112 https://cve.radiocsirt.org/vuln/bdu:2024-04112 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0841 certfr-2024-avi-0841 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0841 https://cve.radiocsirt.org/vuln/euvd-2026-358083 EUVD-2026-358083 https://cve.radiocsirt.org/vuln/euvd-2026-358083 https://cve.radiocsirt.org/vuln/fkie_cve-2024-3154 <p>A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.</p> <p>A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-3154 https://cve.radiocsirt.org/vuln/ghsa-2cgq-h8xw-2v5j <p><strong>Affected:</strong> Go: github.com/cri-o/cri-o</p> <p>### Impact On CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation: ``` --- apiVersion: v1 kind: Pod metadata: name: poc-arbitrary-systemd-property-injection annotations: # I believe that ExecStart with an arbitrary command works here too, # but I haven&#39;t figured out how to marshalize the ExecStart struct to gvariant string. org.systemd.property.SuccessAction: &#34;&#39;poweroff-force&#39;&#34; spec: containers: - name: hello image: [quay.io/podman/hello](http://quay.io/podman/hello) ```</p> <p>This means that any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.</p> <p>Tested with CRI-O v1.24 on minikube. I didn&#39;t test the latest v1.29 because it is incompatible with minikube: https://github.com/kubernetes/minikube/pull/18367</p> <p>Thanks to Cédric Clerget (GitHub ID @cclerget) for finding out that CRI-O just passes pod annotations to OCI annotations: https://github.com/opencontainers/runc/pull/3923#discussion_r1532292536</p> <p>CRI-O has to filter out annotations that have the prefix &#34;org.systemd.property.&#34;</p> <p>See also: - https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson - https://github.com/opencontainers/runc/pull/4217</p> <p>### Workarounds Unfortunately, the only workarounds would involve an external mutating webhook to disallow these annotations</p> <p>### References</p> <p><strong>Affected:</strong> Go: github.com/cri-o/cri-o</p> <p>### Impact On CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation: ``` --- apiVersion: v1 kind: Pod metadata: name: poc-arbitrary-systemd-property-injection annotations: # I believe that ExecStart with an arbitrary command works here too, # but I haven&#39;t figured out how to marshalize the ExecStart struct to gvariant string. org.systemd.property.SuccessAction: &#34;&#39;poweroff-force&#39;&#34; spec: containers: - name: hello image: [quay.io/podman/hello](http://quay.io/podman/hello) ```</p> <p>This means that any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.</p> <p>Tested with CRI-O v1.24 on minikube. I didn&#39;t test the latest v1.29 because it is incompatible with minikube: https://github.com/kubernetes/minikube/pull/18367</p> <p>Thanks to Cédric Clerget (GitHub ID @cclerget) for finding out that CRI-O just passes pod annotations to OCI annotations: https://github.com/opencontainers/runc/pull/3923#discussion_r1532292536</p> <p>CRI-O has to filter out annotations that have the prefix &#34;org.systemd.property.&#34;</p> <p>See also: - https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson - https://github.com/opencontainers/runc/pull/4217</p> <p>### Workarounds Unfortunately, the only workarounds would involve an external mutating webhook to disallow these annotations</p> <p>### References</p> https://cve.radiocsirt.org/vuln/ghsa-2cgq-h8xw-2v5j https://cve.radiocsirt.org/vuln/gsd-2024-3154 gsd-2024-3154 https://cve.radiocsirt.org/vuln/gsd-2024-3154 https://cve.radiocsirt.org/vuln/msrc_cve-2024-3154 msrc_CVE-2024-3154 https://cve.radiocsirt.org/vuln/msrc_cve-2024-3154 https://cve.radiocsirt.org/vuln/oesa-2024-1671 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP2: runc</p> <p>runc is a CLI tool for spawning and running containers according to the OCI specification. Security Fix(es): A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.(CVE-2024-3154)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP2: runc</p> <p>runc is a CLI tool for spawning and running containers according to the OCI specification. Security Fix(es): A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.(CVE-2024-3154)</p> https://cve.radiocsirt.org/vuln/oesa-2024-1671 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14334-1 <p>grype-0.80.1-1.1 on GA media</p> <p>grype-0.80.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:14334-1 https://cve.radiocsirt.org/vuln/rhsa-2024:2669 <p>buildah: Buildah: Container escape via improper bind mount validation cri-o: Arbitrary command injection via pod annotation jose-go: improper handling of highly compressed data</p> <p>buildah: Buildah: Container escape via improper bind mount validation cri-o: Arbitrary command injection via pod annotation jose-go: improper handling of highly compressed data</p> https://cve.radiocsirt.org/vuln/rhsa-2024:2669 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1297 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1297