Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:golang/github.com/cri-o/cri-o@1.23.1
Typegolang
Namespacegithub.com/cri-o
Namecri-o
Version1.23.1
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version1.23.2
Latest_non_vulnerable_version1.31.3
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-s6sw-jsfr-xyhv
vulnerability_id VCID-s6sw-jsfr-xyhv
summary 
Incorrect Permission Assignment for Critical Resource in CRI-O
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-0532.json
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-0532.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-0532
reference_id
reference_type
scores
0
value 0.00185
scoring_system epss
scoring_elements 0.4019
published_at 2026-04-21T12:55:00Z
1
value 0.00185
scoring_system epss
scoring_elements 0.40133
published_at 2026-04-01T12:55:00Z
2
value 0.00185
scoring_system epss
scoring_elements 0.40284
published_at 2026-04-08T12:55:00Z
3
value 0.00185
scoring_system epss
scoring_elements 0.40309
published_at 2026-04-04T12:55:00Z
4
value 0.00185
scoring_system epss
scoring_elements 0.40231
published_at 2026-04-07T12:55:00Z
5
value 0.00185
scoring_system epss
scoring_elements 0.40296
published_at 2026-04-09T12:55:00Z
6
value 0.00185
scoring_system epss
scoring_elements 0.40308
published_at 2026-04-11T12:55:00Z
7
value 0.00185
scoring_system epss
scoring_elements 0.4027
published_at 2026-04-12T12:55:00Z
8
value 0.00185
scoring_system epss
scoring_elements 0.40251
published_at 2026-04-13T12:55:00Z
9
value 0.00185
scoring_system epss
scoring_elements 0.40298
published_at 2026-04-16T12:55:00Z
10
value 0.00185
scoring_system epss
scoring_elements 0.40266
published_at 2026-04-18T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-0532
2
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2051730
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=2051730
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/cri-o/cri-o
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/cri-o/cri-o
5
reference_url https://github.com/cri-o/cri-o/pull/5610
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/cri-o/cri-o/pull/5610
6
reference_url https://github.com/cri-o/cri-o/releases/tag/v1.23.1
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/cri-o/cri-o/releases/tag/v1.23.1
7
reference_url https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-0532
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-0532
9
reference_url https://access.redhat.com/errata/RHSA-2022:0055
reference_id RHSA-2022:0055
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:0055
10
reference_url https://access.redhat.com/errata/RHSA-2022:0866
reference_id RHSA-2022:0866
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:0866
11
reference_url https://access.redhat.com/errata/RHSA-2022:0870
reference_id RHSA-2022:0870
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:0870
fixed_packages
0
url pkg:golang/github.com/cri-o/cri-o@1.23.1
purl pkg:golang/github.com/cri-o/cri-o@1.23.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:golang/github.com/cri-o/cri-o@1.23.1
aliases CVE-2022-0532, GHSA-jqmc-79gx-7g8p
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-s6sw-jsfr-xyhv
1
url VCID-w3mr-v5ew-vfcj
vulnerability_id VCID-w3mr-v5ew-vfcj
summary 
Sysctls applied to containers with host IPC or host network namespaces can affect the host
### Impact
Before setting the sysctls for a pod, the pods namespaces must be unshared (created). However, in cases where the pod is using a host network or IPC namespace, a bug in CRI-O caused the namespace creating tool [pinns](https://github.com/cri-o/cri-o/tree/main/pinns/) to configure the sysctls of the host. This allows a malicious user to set sysctls on the host, assuming they have access to hostNetwork and hostIPC.

Any CRI-O cluster after CRI-O 1.18 that drops the infra container
1.22 and 1.23 clusters drop infra container by default, and are thus vulnerable by default.

### Patches
CRI-O versions 1.24.0, 1.23.1, 1.22.2, 1.21.5, 1.20.6, 1.19.5 all have the patches.

### Workarounds
Users can set `manage_ns_lifecycle` to false, which causes the sysctls to be configured by the OCI runtime, which typically filter these cases. This option is available in 1.20 and 1.19. Newer versions don't have this option.
An admission webhook could also be created to deny pods that use host IPC or network namespaces and also attempt to configure sysctls related to that namespace.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the CRI-O repo](http://github.com/cri-o/cri-o/issues)
* To make a report, email your vulnerability to the private
[cncf-crio-security@lists.cncf.io](mailto:cncf-crio-security@lists.cncf.io) list
with the security details and the details expected for [all CRI-O bug
reports](https://github.com/cri-o/cri-o/blob/main/.github/ISSUE_TEMPLATE/bug-report.yml).
references
0
reference_url https://github.com/cri-o/cri-o
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/cri-o/cri-o
1
reference_url https://github.com/cri-o/cri-o/security/advisories/GHSA-w2j5-3rcx-vx7x
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/cri-o/cri-o/security/advisories/GHSA-w2j5-3rcx-vx7x
fixed_packages
0
url pkg:golang/github.com/cri-o/cri-o@1.19.5
purl pkg:golang/github.com/cri-o/cri-o@1.19.5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:golang/github.com/cri-o/cri-o@1.19.5
1
url pkg:golang/github.com/cri-o/cri-o@1.20.6
purl pkg:golang/github.com/cri-o/cri-o@1.20.6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:golang/github.com/cri-o/cri-o@1.20.6
2
url pkg:golang/github.com/cri-o/cri-o@1.21.5
purl pkg:golang/github.com/cri-o/cri-o@1.21.5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:golang/github.com/cri-o/cri-o@1.21.5
3
url pkg:golang/github.com/cri-o/cri-o@1.22.2
purl pkg:golang/github.com/cri-o/cri-o@1.22.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:golang/github.com/cri-o/cri-o@1.22.2
4
url pkg:golang/github.com/cri-o/cri-o@1.23.1
purl pkg:golang/github.com/cri-o/cri-o@1.23.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:golang/github.com/cri-o/cri-o@1.23.1
aliases GHSA-w2j5-3rcx-vx7x
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-w3mr-v5ew-vfcj
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:golang/github.com/cri-o/cri-o@1.23.1