{"id":"CVE-2024-8676","aliases":["AZL-53540","EUVD-2024-3348","GHSA-7p9f-6x8j-gxxp","GO-2024-3292","RHBA-2024:10826","RHSA-2025:0648","RHSA-2025:1908","openSUSE-SU-2024:14567-1"],"status":"published","title":"Cri-o: checkpoint restore can be triggered from different namespaces","description":"A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0075,"percentile":0.55255,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285"],"published":"2024-11-26T19:15:48Z","modified":"2026-11-05T21:15:46Z","fixes":[{"ecosystem":"Go","package":"github.com/cri-o/cri-o","fixed_in":["1.29.11","1.30.8","1.31.3"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-o","fixed_in":["0:1.29.11-3.rhaos4.16.git16d9bd6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-o-debuginfo","fixed_in":["0:1.29.11-3.rhaos4.16.git16d9bd6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-o-debugsource","fixed_in":["0:1.29.11-3.rhaos4.16.git16d9bd6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-o","fixed_in":["0:1.29.11-3.rhaos4.16.git16d9bd6.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-o-debuginfo","fixed_in":["0:1.29.11-3.rhaos4.16.git16d9bd6.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-o-debugsource","fixed_in":["0:1.29.11-3.rhaos4.16.git16d9bd6.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.15::el8","package":"cri-o","fixed_in":["0:1.28.11-7.rhaos4.15.gitc4c0556.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.15::el8","package":"cri-o-debuginfo","fixed_in":["0:1.28.11-7.rhaos4.15.gitc4c0556.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.15::el8","package":"cri-o-debugsource","fixed_in":["0:1.28.11-7.rhaos4.15.gitc4c0556.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.15::el9","package":"cri-o","fixed_in":["0:1.28.11-7.rhaos4.15.gitc4c0556.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.15::el9","package":"cri-o-debuginfo","fixed_in":["0:1.28.11-7.rhaos4.15.gitc4c0556.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.15::el9","package":"cri-o-debugsource","fixed_in":["0:1.28.11-7.rhaos4.15.gitc4c0556.el9"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.11"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.0"},{"fixed":"1.30.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.31.0"},{"fixed":"1.31.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.29.11"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"SEMVER","events":[{"introduced":"1.30.0"},{"fixed":"1.30.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"SEMVER","events":[{"introduced":"1.31.0"},{"fixed":"1.31.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.29.11"},{"introduced":"1.30.0"},{"fixed":"1.30.8"},{"introduced":"1.31.0"},{"fixed":"1.31.3"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.11-3.rhaos4.16.git16d9bd6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.11-3.rhaos4.16.git16d9bd6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.11-3.rhaos4.16.git16d9bd6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.11-3.rhaos4.16.git16d9bd6.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.11-3.rhaos4.16.git16d9bd6.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.11-3.rhaos4.16.git16d9bd6.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.11-7.rhaos4.15.gitc4c0556.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.11-7.rhaos4.15.gitc4c0556.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.11-7.rhaos4.15.gitc4c0556.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.11-7.rhaos4.15.gitc4c0556.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.11-7.rhaos4.15.gitc4c0556.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.11-7.rhaos4.15.gitc4c0556.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.5-5.rhaos4.18.git6dfa0a6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.5-5.rhaos4.18.git6dfa0a6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.5-5.rhaos4.18.git6dfa0a6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.5-5.rhaos4.18.git6dfa0a6.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.5-5.rhaos4.18.git6dfa0a6.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.5-5.rhaos4.18.git6dfa0a6.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.12-1.rhaos4.18.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.12-1.rhaos4.18.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.12-1.rhaos4.18.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.12-1.rhaos4.18.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.12-1.rhaos4.18.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241209T183251-1.1"}]}],"bundled":21}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 3.11"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.15"},{"vendor":"red hat","product":"red hat openshift container platform 4.16"},{"vendor":"red hat","product":"red hat openshift container platform 4.17"},{"vendor":"red hat","product":"red hat openshift container platform 4.18"}],"references":[{"url":"https://access.redhat.com/errata/RHBA-2024:10826","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0648","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1908","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3297","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:4211","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9765","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-8676","tags":["vdb-entry","x_refsource_REDHAT","advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2313842","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://github.com/cri-o/cri-o/security/advisories/GHSA-7p9f-6x8j-gxxp","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8676","tags":["web","advisory"]},{"url":"https://github.com/cri-o/cri-o/commit/e8e7dcb7838d11b5157976bf3e31a5840bb77de7","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-7p9f-6x8j-gxxp"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8676.json","tags":["advisory"]},{"url":"https://github.com/cri-o/cri-o","tags":["package"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_10826.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-8676","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0648.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326231","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1908.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-11218","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-11218","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11218","tags":["advisory"]},{"url":"https://github.com/containers/buildah/pull/5918","tags":["article"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8676","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-8676","title":"Cri-o: checkpoint restore can be triggered from different namespaces","description":"A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.","status":"published","published":"2024-11-26T19:15:48.475Z","modified":"2026-11-05T14:44:43.958Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2024-3348","description":"A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.","status":"published","published":"2024-11-26T19:15:48Z","modified":"2026-11-05T14:44:43Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-05T16:59:57.067043Z"}],"ghsa":[{"id":"GHSA-7p9f-6x8j-gxxp","title":"CRI-O: Maliciously structured checkpoint file can gain arbitrary node access","description":"### Impact\n\n### Patches\n1.31.1, 1.30.6, 1.29.8\n\n### Workarounds\nset `enable_criu_support = false` \n\n### References\n_Are there any links users can visit to find out more?_","status":"published","published":"2024-11-26T21:50:30Z","modified":"2025-07-02T14:28:00Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:38:48.783737Z"}],"nvd":[{"id":"CVE-2024-8676","description":"A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.","status":"published","published":"2024-11-26T20:15:34.26Z","modified":"2026-11-05T15:17:00.757Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-05T19:55:50.758755Z"}],"osv":[{"id":"CVE-2024-8676","title":"Cri-o: checkpoint restore can be triggered from different namespaces","description":"A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.","status":"published","published":"2024-11-26T19:15:48.475Z","modified":"2026-11-07T02:30:35.453959751Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-07T03:07:55.074849Z"},{"id":"GHSA-7p9f-6x8j-gxxp","title":"CRI-O: Maliciously structured checkpoint file can gain arbitrary node access","description":"### Impact\n\n### Patches\n1.31.1, 1.30.6, 1.29.8\n\n### Workarounds\nset `enable_criu_support = false` \n\n### References\n_Are there any links users can visit to find out more?_","status":"published","published":"2024-11-26T21:50:30Z","modified":"2025-07-02T14:27:58Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"RHBA-2024:10826","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 4.16.26 packages and security update","status":"published","published":"2024-12-18T10:04:47Z","modified":"2026-10-13T10:05:47Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2025:0648","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.44 security update","status":"published","published":"2025-01-30T10:03:40Z","modified":"2026-10-14T10:06:09Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:1908","title":"Red Hat Security Advisory: OpenShift Container Platform 4.18.2 packages and security update","status":"published","published":"2025-03-05T10:03:09Z","modified":"2026-10-14T10:08:36Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"AZL-53540","title":"CVE-2024-8676 affecting package cri-o 1.30.1-1","description":"A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.","status":"published","published":"2024-11-26T20:15:34Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.828909Z"},{"id":"GO-2024-3292","title":"CRI-O: Maliciously structured checkpoint file can gain arbitrary node access in github.com/cri-o/cri-o","description":"CRI-O: Maliciously structured checkpoint file can gain arbitrary node access in github.com/cri-o/cri-o","status":"published","published":"2024-12-04T16:25:24Z","modified":"2026-03-03T04:56:03.231929Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"openSUSE-SU-2024:14567-1","title":"govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20241209T183251-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-11T00:00:00Z","modified":"2026-02-04T02:48:53.761072Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}