Every CVE Search/ Get API key

CVE-2024-3154

Cri-o: arbitrary command injection via pod annotation

7.2 HighFix available

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.42%Up 1.4 points since Apr 26, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.2

Cri-o: arbitrary command injection via pod annotation

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

Record
CVE-2024-3154
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
EUVDEUVD-2024-1060 7.2

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

Record
EUVD-2024-1060
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-2cgq-h8xw-2v5j 7.2

CRI-O vulnerable to an arbitrary systemd property injection

Impact

On CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation:

---
apiVersion: v1
kind: Pod
metadata:
  name: poc-arbitrary-systemd-property-injection
  annotations:
    # I believe that ExecStart with an arbitrary command works here too,
    # but I haven't figured out how to marshalize the ExecStart struct to gvariant string.
    org.systemd.property.SuccessAction: "'poweroff-force'"
spec:
  containers:
    - name: hello
      image: [quay.io/podman/hello](http://quay.io/podman/hello)

This means that any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

Tested with CRI-O v1.24 on minikube. I didn't test the latest v1.29 because it is incompatible with minikube: https://github.com/kubernetes/minikube/pull/18367

Thanks to Cédric Clerget (GitHub ID @cclerget) for finding out that CRI-O just passes pod annotations to OCI annotations: https://github.com/opencontainers/runc/pull/3923#discussion_r1532292536

CRI-O has to filter out annotations that have the prefix "org.systemd.property."

See also:

Workarounds

Unfortunately, the only workarounds would involve an external mutating webhook to disallow these annotations

References

Record
GHSA-2cgq-h8xw-2v5j
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
NVD 7.2

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

Record
CVE-2024-3154
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
OSV 7.2

Cri-o: arbitrary command injection via pod annotation

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

Record
CVE-2024-3154
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
OSVGHSA-2cgq-h8xw-2v5j 7.2

CRI-O vulnerable to an arbitrary systemd property injection

Impact

On CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation:

---
apiVersion: v1
kind: Pod
metadata:
  name: poc-arbitrary-systemd-property-injection
  annotations:
    # I believe that ExecStart with an arbitrary command works here too,
    # but I haven't figured out how to marshalize the ExecStart struct to gvariant string.
    org.systemd.property.SuccessAction: "'poweroff-force'"
spec:
  containers:
    - name: hello
      image: [quay.io/podman/hello](http://quay.io/podman/hello)

This means that any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

Tested with CRI-O v1.24 on minikube. I didn't test the latest v1.29 because it is incompatible with minikube: https://github.com/kubernetes/minikube/pull/18367

Thanks to Cédric Clerget (GitHub ID @cclerget) for finding out that CRI-O just passes pod annotations to OCI annotations: https://github.com/opencontainers/runc/pull/3923#discussion_r1532292536

CRI-O has to filter out annotations that have the prefix "org.systemd.property."

See also:

Workarounds

Unfortunately, the only workarounds would involve an external mutating webhook to disallow these annotations

References

Record
GHSA-2cgq-h8xw-2v5j
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
Show 10 moreShow less
OSVOESA-2024-1671 7.2

runc security update

runc is a CLI tool for spawning and running containers according to the OCI specification.

Security Fix(es):

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.(CVE-2024-3154)

Record
OESA-2024-1671
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-1675 7.2

runc security update

runc is a CLI tool for spawning and running containers according to the OCI specification.

Security Fix(es):

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.(CVE-2024-3154)

Record
OESA-2024-1675
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-1688 7.2

runc security update

runc is a CLI tool for spawning and running containers according to the OCI specification.

Security Fix(es):

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.(CVE-2024-3154)

Record
OESA-2024-1688
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:2669 8.6

Red Hat Security Advisory: OpenShift Container Platform 4.15.12 security update

Record
RHSA-2024:2669
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:2672 8.6

Red Hat Security Advisory: OpenShift Container Platform 4.14.24 packages and security update

Record
RHSA-2024:2672
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:2784 8.6

Red Hat Security Advisory: OpenShift Container Platform 4.12.57 security update

Record
RHSA-2024:2784
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:3496 7.2

Red Hat Security Advisory: OpenShift Container Platform 4.13.43 security update

Record
RHSA-2024:3496
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-42307 No score

CVE-2024-3154 affecting package cri-o for versions less than 1.22.3-2

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

Record
AZL-42307
Updated
2026-11-02
OSVGO-2024-2791 No score

CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o

CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o

Record
GO-2024-2791
Updated
2026-11-02
OSVopenSUSE-SU-2024:14334-1 No score

grype-0.80.1-1.1 on GA media

These are all security issues fixed in the grype-0.80.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14334-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/cri-o/cri-o
Go
 1.29.0 to 1.29.3
1.29.4
github.com/cri-o/cri-o
Go
 1.28.0 to 1.28.5
1.28.6
github.com/cri-o/cri-o
Go
 through 1.27.5
1.27.6
cri-o
Azure Linux:2
 before 1.22.3-2
1.22.3-2
github.com/cri-o/cri-o
Go
 1.29.0 up to 1.29.4
1.29.4
github.com/cri-o/cri-o
Go
 1.28.0 up to 1.28.6
1.28.6
github.com/cri-o/cri-o
Go
 before 1.27.6
1.27.6
github.com/cri-o/cri-o
Go
 before 1.27.6, 1.28.0 up to 1.28.6, 1.29.0 up to 1.29.4
1.27.61.28.61.29.4
runc
openEuler:22.03-LTS-SP2
 before docker-1.1.3-25.oe2203sp2
docker-1.1.3-25.oe2203sp2
runc
openEuler:22.03-LTS-SP3
 before 1.1.3-26.oe2203sp3
1.1.3-26.oe2203sp3
Show 96 moreShow less
Affected packages
PackageAffectedFixed
runc
openEuler:22.03-LTS-SP1
 before docker-1.1.3-25.oe2203sp1
docker-1.1.3-25.oe2203sp1
podman
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el8
3:4.4.1-23.2.rhaos4.15.el8
podman-catatonit
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el8
3:4.4.1-23.2.rhaos4.15.el8
podman-catatonit-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el8
3:4.4.1-23.2.rhaos4.15.el8
podman-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el8
3:4.4.1-23.2.rhaos4.15.el8
podman-debugsource
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el8
3:4.4.1-23.2.rhaos4.15.el8
podman-docker
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el8
3:4.4.1-23.2.rhaos4.15.el8
podman-gvproxy
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el8
3:4.4.1-23.2.rhaos4.15.el8
podman-gvproxy-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el8
3:4.4.1-23.2.rhaos4.15.el8
podman-plugins
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el8
3:4.4.1-23.2.rhaos4.15.el8
podman-plugins-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el8
3:4.4.1-23.2.rhaos4.15.el8
podman-remote
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el8
3:4.4.1-23.2.rhaos4.15.el8
podman-remote-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el8
3:4.4.1-23.2.rhaos4.15.el8
podman-tests
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el8
3:4.4.1-23.2.rhaos4.15.el8
podman
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el9
3:4.4.1-23.2.rhaos4.15.el9
podman-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el9
3:4.4.1-23.2.rhaos4.15.el9
podman-debugsource
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el9
3:4.4.1-23.2.rhaos4.15.el9
podman-docker
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el9
3:4.4.1-23.2.rhaos4.15.el9
podman-gvproxy
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el9
3:4.4.1-23.2.rhaos4.15.el9
podman-gvproxy-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el9
3:4.4.1-23.2.rhaos4.15.el9
podman-plugins
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el9
3:4.4.1-23.2.rhaos4.15.el9
podman-plugins-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el9
3:4.4.1-23.2.rhaos4.15.el9
podman-remote
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el9
3:4.4.1-23.2.rhaos4.15.el9
podman-remote-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el9
3:4.4.1-23.2.rhaos4.15.el9
podman-tests
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-23.2.rhaos4.15.el9
3:4.4.1-23.2.rhaos4.15.el9
cri-o
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:1.28.6-2.rhaos4.15.git77bbb1c.el8
0:1.28.6-2.rhaos4.15.git77bbb1c.el8
cri-o-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:1.28.6-2.rhaos4.15.git77bbb1c.el8
0:1.28.6-2.rhaos4.15.git77bbb1c.el8
cri-o-debugsource
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:1.28.6-2.rhaos4.15.git77bbb1c.el8
0:1.28.6-2.rhaos4.15.git77bbb1c.el8
cri-o
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:1.28.6-2.rhaos4.15.git77bbb1c.el9
0:1.28.6-2.rhaos4.15.git77bbb1c.el9
cri-o-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:1.28.6-2.rhaos4.15.git77bbb1c.el9
0:1.28.6-2.rhaos4.15.git77bbb1c.el9
cri-o-debugsource
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:1.28.6-2.rhaos4.15.git77bbb1c.el9
0:1.28.6-2.rhaos4.15.git77bbb1c.el9
openshift
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el8
0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el8
openshift-hyperkube
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el8
0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el8
openshift
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el9
0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el9
openshift-hyperkube
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el9
0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el9
podman
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el8
3:4.4.1-13.4.rhaos4.14.el8
podman-catatonit
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el8
3:4.4.1-13.4.rhaos4.14.el8
podman-catatonit-debuginfo
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el8
3:4.4.1-13.4.rhaos4.14.el8
podman-debuginfo
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el8
3:4.4.1-13.4.rhaos4.14.el8
podman-debugsource
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el8
3:4.4.1-13.4.rhaos4.14.el8
podman-docker
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el8
3:4.4.1-13.4.rhaos4.14.el8
podman-gvproxy
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el8
3:4.4.1-13.4.rhaos4.14.el8
podman-gvproxy-debuginfo
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el8
3:4.4.1-13.4.rhaos4.14.el8
podman-plugins
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el8
3:4.4.1-13.4.rhaos4.14.el8
podman-plugins-debuginfo
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el8
3:4.4.1-13.4.rhaos4.14.el8
podman-remote
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el8
3:4.4.1-13.4.rhaos4.14.el8
podman-remote-debuginfo
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el8
3:4.4.1-13.4.rhaos4.14.el8
podman-tests
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el8
3:4.4.1-13.4.rhaos4.14.el8
podman
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el9
3:4.4.1-13.4.rhaos4.14.el9
podman-debuginfo
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el9
3:4.4.1-13.4.rhaos4.14.el9
podman-debugsource
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el9
3:4.4.1-13.4.rhaos4.14.el9
podman-docker
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el9
3:4.4.1-13.4.rhaos4.14.el9
podman-gvproxy
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el9
3:4.4.1-13.4.rhaos4.14.el9
podman-gvproxy-debuginfo
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el9
3:4.4.1-13.4.rhaos4.14.el9
podman-plugins
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el9
3:4.4.1-13.4.rhaos4.14.el9
podman-plugins-debuginfo
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el9
3:4.4.1-13.4.rhaos4.14.el9
podman-remote
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el9
3:4.4.1-13.4.rhaos4.14.el9
podman-remote-debuginfo
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el9
3:4.4.1-13.4.rhaos4.14.el9
podman-tests
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 3:4.4.1-13.4.rhaos4.14.el9
3:4.4.1-13.4.rhaos4.14.el9
cri-o
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el8
0:1.27.6-2.rhaos4.14.gitb3bd0bf.el8
cri-o-debuginfo
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el8
0:1.27.6-2.rhaos4.14.gitb3bd0bf.el8
cri-o-debugsource
Red Hat:openshift:4.14::el8
From an advisory covering 4 CVEs
 before 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el8
0:1.27.6-2.rhaos4.14.gitb3bd0bf.el8
cri-o
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9
0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9
cri-o-debuginfo
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9
0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9
cri-o-debugsource
Red Hat:openshift:4.14::el9
From an advisory covering 4 CVEs
 before 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9
0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9
podman
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-3.2.rhaos4.12.el8
3:4.4.1-3.2.rhaos4.12.el8
podman-catatonit
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-3.2.rhaos4.12.el8
3:4.4.1-3.2.rhaos4.12.el8
podman-catatonit-debuginfo
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-3.2.rhaos4.12.el8
3:4.4.1-3.2.rhaos4.12.el8
podman-debuginfo
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-3.2.rhaos4.12.el8
3:4.4.1-3.2.rhaos4.12.el8
podman-debugsource
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-3.2.rhaos4.12.el8
3:4.4.1-3.2.rhaos4.12.el8
podman-docker
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-3.2.rhaos4.12.el8
3:4.4.1-3.2.rhaos4.12.el8
podman-gvproxy
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-3.2.rhaos4.12.el8
3:4.4.1-3.2.rhaos4.12.el8
podman-gvproxy-debuginfo
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-3.2.rhaos4.12.el8
3:4.4.1-3.2.rhaos4.12.el8
podman-plugins
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-3.2.rhaos4.12.el8
3:4.4.1-3.2.rhaos4.12.el8
podman-plugins-debuginfo
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-3.2.rhaos4.12.el8
3:4.4.1-3.2.rhaos4.12.el8
podman-remote
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-3.2.rhaos4.12.el8
3:4.4.1-3.2.rhaos4.12.el8
podman-remote-debuginfo
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-3.2.rhaos4.12.el8
3:4.4.1-3.2.rhaos4.12.el8
podman-tests
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-3.2.rhaos4.12.el8
3:4.4.1-3.2.rhaos4.12.el8
cri-o
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 0:1.25.5-16.2.rhaos4.12.gitcb09013.el8
0:1.25.5-16.2.rhaos4.12.gitcb09013.el8
cri-o-debuginfo
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 0:1.25.5-16.2.rhaos4.12.gitcb09013.el8
0:1.25.5-16.2.rhaos4.12.gitcb09013.el8
cri-o-debugsource
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 0:1.25.5-16.2.rhaos4.12.gitcb09013.el8
0:1.25.5-16.2.rhaos4.12.gitcb09013.el8
skopeo
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 2:1.9.4-4.3.rhaos4.12.el8
2:1.9.4-4.3.rhaos4.12.el8
skopeo-debuginfo
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 2:1.9.4-4.3.rhaos4.12.el8
2:1.9.4-4.3.rhaos4.12.el8
skopeo-debugsource
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 2:1.9.4-4.3.rhaos4.12.el8
2:1.9.4-4.3.rhaos4.12.el8
skopeo-tests
Red Hat:openshift:4.12::el8
From an advisory covering 3 CVEs
 before 2:1.9.4-4.3.rhaos4.12.el8
2:1.9.4-4.3.rhaos4.12.el8
skopeo
Red Hat:openshift:4.12::el9
From an advisory covering 3 CVEs
 before 2:1.9.4-4.3.rhaos4.12.el9
2:1.9.4-4.3.rhaos4.12.el9
skopeo-debuginfo
Red Hat:openshift:4.12::el9
From an advisory covering 3 CVEs
 before 2:1.9.4-4.3.rhaos4.12.el9
2:1.9.4-4.3.rhaos4.12.el9
skopeo-debugsource
Red Hat:openshift:4.12::el9
From an advisory covering 3 CVEs
 before 2:1.9.4-4.3.rhaos4.12.el9
2:1.9.4-4.3.rhaos4.12.el9
skopeo-tests
Red Hat:openshift:4.12::el9
From an advisory covering 3 CVEs
 before 2:1.9.4-4.3.rhaos4.12.el9
2:1.9.4-4.3.rhaos4.12.el9
cri-o
Red Hat:openshift:4.13::el8
 before 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el8
0:1.26.5-16.2.rhaos4.13.git67e2a9d.el8
cri-o-debuginfo
Red Hat:openshift:4.13::el8
 before 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el8
0:1.26.5-16.2.rhaos4.13.git67e2a9d.el8
cri-o-debugsource
Red Hat:openshift:4.13::el8
 before 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el8
0:1.26.5-16.2.rhaos4.13.git67e2a9d.el8
cri-o
Red Hat:openshift:4.13::el9
 before 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9
0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9
cri-o-debuginfo
Red Hat:openshift:4.13::el9
 before 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9
0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9
cri-o-debugsource
Red Hat:openshift:4.13::el9
 before 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9
0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9
grype
openSUSE:Tumbleweed
 before 0.80.1-1.1
0.80.1-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-3154 is a high vulnerability (CVSS 7.2) in Red Hat Openshift Container Platform 3.11, published April 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.42%, the 72nd percentile. Fixed in github.com/cri-o/cri-o 1.29.4.

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open