{"id":"CVE-2024-3154","aliases":["AZL-42307","EUVD-2024-1060","GHSA-2cgq-h8xw-2v5j","GO-2024-2791","OESA-2024-1671","OESA-2024-1675","OESA-2024-1688","RHSA-2024:2669","RHSA-2024:2672","RHSA-2024:2784","RHSA-2024:3496","openSUSE-SU-2024:14334-1"],"status":"published","title":"Cri-o: arbitrary command injection via pod annotation","description":"A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01418,"percentile":0.72985,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2024-04-26T03:12:38Z","modified":"2026-10-28T02:30:41Z","fixes":[{"ecosystem":"Go","package":"github.com/cri-o/cri-o","fixed_in":["1.29.4","1.28.6","1.27.6"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"cri-o","fixed_in":["1.22.3-2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"runc","fixed_in":["docker-1.1.3-25.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"runc","fixed_in":["1.1.3-26.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"runc","fixed_in":["docker-1.1.3-25.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o","fixed_in":["0:1.26.5-16.2.rhaos4.13.git67e2a9d.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o-debuginfo","fixed_in":["0:1.26.5-16.2.rhaos4.13.git67e2a9d.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o-debugsource","fixed_in":["0:1.26.5-16.2.rhaos4.13.git67e2a9d.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o","fixed_in":["0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o-debuginfo","fixed_in":["0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o-debugsource","fixed_in":["0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"grype","fixed_in":["0.80.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.29.0"},{"last_affected":"1.29.3"},{"fixed":"1.29.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0"},{"last_affected":"1.28.5"},{"fixed":"1.28.6"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.27.5"},{"fixed":"1.27.6"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"SEMVER","events":[{"introduced":"1.29.0"},{"fixed":"1.29.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"SEMVER","events":[{"introduced":"1.28.0"},{"fixed":"1.28.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.6"},{"introduced":"1.28.0"},{"fixed":"1.28.6"},{"introduced":"1.29.0"},{"fixed":"1.29.4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"docker-1.1.3-25.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-26.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"docker-1.1.3-25.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-catatonit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-23.2.rhaos4.15.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.6-2.rhaos4.15.git77bbb1c.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.6-2.rhaos4.15.git77bbb1c.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.6-2.rhaos4.15.git77bbb1c.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.6-2.rhaos4.15.git77bbb1c.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.6-2.rhaos4.15.git77bbb1c.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.6-2.rhaos4.15.git77bbb1c.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"podman-catatonit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-13.4.rhaos4.14.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.6-2.rhaos4.14.gitb3bd0bf.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.6-2.rhaos4.14.gitb3bd0bf.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.6-2.rhaos4.14.gitb3bd0bf.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.2.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.2.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-catatonit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.2.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.2.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.2.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.2.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.2.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.2.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.2.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.2.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.2.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.2.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.4.1-3.2.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.5-16.2.rhaos4.12.gitcb09013.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.5-16.2.rhaos4.12.gitcb09013.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.5-16.2.rhaos4.12.gitcb09013.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.4-4.3.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.4-4.3.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.4-4.3.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.4-4.3.rhaos4.12.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.4-4.3.rhaos4.12.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el9","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.4-4.3.rhaos4.12.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el9","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.4-4.3.rhaos4.12.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el9","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.4-4.3.rhaos4.12.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.5-16.2.rhaos4.13.git67e2a9d.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.5-16.2.rhaos4.13.git67e2a9d.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.5-16.2.rhaos4.13.git67e2a9d.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.80.1-1.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat openshift container platform 3.11"},{"vendor":"red hat","product":"red hat openshift container platform 4.12"},{"vendor":"red hat","product":"red hat openshift container platform 4.13"},{"vendor":"red hat","product":"red hat openshift container platform 4.14"},{"vendor":"red hat","product":"red hat openshift container platform 4.15"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:2669","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2672","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2784","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3496","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-3154","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2272532","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","report","web"]},{"url":"https://github.com/cri-o/cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j","tags":["x_transferred","advisory","web","article"]},{"url":"https://github.com/opencontainers/runc/pull/4217","tags":["x_transferred","fix","web","article"]},{"url":"https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson","tags":["x_transferred","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3154","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2cgq-h8xw-2v5j"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3154.json","tags":["advisory"]},{"url":"https://github.com/cri-o/cri-o","tags":["package"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1671","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1675","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1688","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2265513","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268854","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2669.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1753","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1753","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1753","tags":["advisory"]},{"url":"https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf","tags":["article"]},{"url":"https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2658","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-3154","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28180","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28180","tags":["advisory"]},{"url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268273","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2672.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45288","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45288","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45288","tags":["advisory"]},{"url":"https://nowotarski.info/http2-continuation-flood/","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2687","tags":["advisory"]},{"url":"https://www.kb.cert.org/vuls/id/421644","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2784.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3496.json","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3154","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-3154","title":"Cri-o: arbitrary command injection via pod annotation","description":"A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.","status":"published","published":"2024-04-26T03:12:38.036Z","modified":"2026-08-24T14:00:29.052Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:10.961618Z"}],"euvd":[{"id":"EUVD-2024-1060","description":"A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.","status":"published","published":"2024-04-26T03:12:38Z","modified":"2026-08-24T14:00:29Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:34.936274Z"}],"ghsa":[{"id":"GHSA-2cgq-h8xw-2v5j","title":"CRI-O vulnerable to an arbitrary systemd property injection","description":"### Impact\nOn CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation:\n```\n---\napiVersion: v1\nkind: Pod\nmetadata:\n  name: poc-arbitrary-systemd-property-injection\n  annotations:\n    # I believe that ExecStart with an arbitrary command works here too,\n    # but I haven't figured out how to marshalize the ExecStart struct to gvariant string.\n    org.systemd.property.SuccessAction: \"'poweroff-force'\"\nspec:\n  containers:\n    - name: hello\n      image: [quay.io/podman/hello](http://quay.io/podman/hello)\n```\n\nThis means that any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.\n\nTested with CRI-O v1.24 on minikube.\nI didn't test the latest v1.29 because it is incompatible with minikube: https://github.com/kubernetes/minikube/pull/18367\n\nThanks to Cédric Clerget (GitHub ID @cclerget) for finding out that CRI-O just passes pod annotations to OCI annotations:\nhttps://github.com/opencontainers/runc/pull/3923#discussion_r1532292536\n\nCRI-O has to filter out annotations that have the prefix \"org.systemd.property.\"\n\nSee also:\n- https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson\n- https://github.com/opencontainers/runc/pull/4217\n\n\n### Workarounds\nUnfortunately, the only workarounds would involve an external mutating webhook to disallow these annotations\n\n### References\n\n","status":"published","published":"2024-04-30T09:39:38Z","modified":"2024-05-01T13:06:50Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:37:47.338362Z"}],"nvd":[{"id":"CVE-2024-3154","description":"A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.","status":"published","published":"2024-04-26T04:15:09.217Z","modified":"2026-08-24T15:16:37.21Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:09:53.50104Z"}],"osv":[{"id":"CVE-2024-3154","title":"Cri-o: arbitrary command injection via pod annotation","description":"A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.","status":"published","published":"2024-04-26T03:12:38.036Z","modified":"2026-10-28T02:30:41.431427972Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"GHSA-2cgq-h8xw-2v5j","title":"CRI-O vulnerable to an arbitrary systemd property injection","description":"### Impact\nOn CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation:\n```\n---\napiVersion: v1\nkind: Pod\nmetadata:\n  name: poc-arbitrary-systemd-property-injection\n  annotations:\n    # I believe that ExecStart with an arbitrary command works here too,\n    # but I haven't figured out how to marshalize the ExecStart struct to gvariant string.\n    org.systemd.property.SuccessAction: \"'poweroff-force'\"\nspec:\n  containers:\n    - name: hello\n      image: [quay.io/podman/hello](http://quay.io/podman/hello)\n```\n\nThis means that any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.\n\nTested with CRI-O v1.24 on minikube.\nI didn't test the latest v1.29 because it is incompatible with minikube: https://github.com/kubernetes/minikube/pull/18367\n\nThanks to Cédric Clerget (GitHub ID @cclerget) for finding out that CRI-O just passes pod annotations to OCI annotations:\nhttps://github.com/opencontainers/runc/pull/3923#discussion_r1532292536\n\nCRI-O has to filter out annotations that have the prefix \"org.systemd.property.\"\n\nSee also:\n- https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson\n- https://github.com/opencontainers/runc/pull/4217\n\n\n### Workarounds\nUnfortunately, the only workarounds would involve an external mutating webhook to disallow these annotations\n\n### References\n\n","status":"published","published":"2024-04-30T09:39:38Z","modified":"2026-09-10T03:50:11.111845239Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"OESA-2024-1671","title":"runc security update","description":"runc is a CLI tool for spawning and running containers according to the OCI specification.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.(CVE-2024-3154)","status":"published","published":"2024-05-31T11:07:08Z","modified":"2026-08-18T01:17:23.043129053Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1675","title":"runc security update","description":"runc is a CLI tool for spawning and running containers according to the OCI specification.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.(CVE-2024-3154)","status":"published","published":"2024-05-31T11:07:08Z","modified":"2026-08-18T01:17:23.06939641Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1688","title":"runc security update","description":"runc is a CLI tool for spawning and running containers according to the OCI specification.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.(CVE-2024-3154)","status":"published","published":"2024-05-31T11:07:09Z","modified":"2026-08-18T01:17:23.010652152Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2024:2669","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.12 security update","status":"published","published":"2024-10-02T10:56:03Z","modified":"2026-10-16T10:04:25Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2672","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.24 packages and security update","status":"published","published":"2024-10-02T10:56:13Z","modified":"2026-10-16T10:04:26Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2784","title":"Red Hat Security Advisory: OpenShift Container Platform 4.12.57 security update","status":"published","published":"2024-10-02T10:56:50Z","modified":"2026-10-16T10:04:31Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3496","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.43 security update","status":"published","published":"2024-09-23T18:33:11Z","modified":"2026-08-07T10:14:47Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"AZL-42307","title":"CVE-2024-3154 affecting package cri-o for versions less than 1.22.3-2","description":"A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.","status":"published","published":"2024-04-26T04:15:09Z","modified":"2026-04-21T04:29:29.862842Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"GO-2024-2791","title":"CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o","description":"CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o","status":"published","published":"2024-06-04T15:19:21Z","modified":"2026-02-04T04:11:38.61981Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"openSUSE-SU-2024:14334-1","title":"grype-0.80.1-1.1 on GA media","description":"These are all security issues fixed in the grype-0.80.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-09-12T00:00:00Z","modified":"2026-02-04T03:47:47.888226Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}