{"id":"CVE-2026-15809","aliases":["AZL-92391","EUVD-2026-44661","GHSA-9gq4-2485-q63q","RHSA-2026:57361","RHSA-2026:60444","RHSA-2026:60449","RHSA-2026:60452","RHSA-2026:62548","RHSA-2026:65838","RHSA-2026:65906","RHSA-2026:66385","RHSA-2026:67836","RHSA-2026:67856","RHSA-2026:70585"],"status":"published","title":"Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env","description":"A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00183,"percentile":0.07939,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-116","CWE-134"],"published":"2026-07-15T12:32:42Z","modified":"2026-11-05T05:36:30Z","affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.35.6-5.rhaos4.22.git41f610b.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.35.6-5.rhaos4.22.git41f610b.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.35.6-5.rhaos4.22.git41f610b.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608190726.p2.g05744ab.assembly.stream.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608190726.p2.g05744ab.assembly.stream.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608190726.p2.g05744ab.assembly.stream.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608190726.p2.g05744ab.assembly.stream.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-kube-apiserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608190726.p2.g05744ab.assembly.stream.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-kube-controller-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608190726.p2.g05744ab.assembly.stream.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-kube-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608190726.p2.g05744ab.assembly.stream.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-kubelet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608190726.p2.g05744ab.assembly.stream.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608131626.p2.g7ec2e14.assembly.stream.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608131626.p2.g7ec2e14.assembly.stream.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el8","package":"ose-aws-ecr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608131626.p2.gb4bad3f.assembly.stream.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el8","package":"ose-azure-acr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608131626.p2.ga17a3e3.assembly.stream.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el8","package":"ose-gcp-gcr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608131626.p2.gea31ab8.assembly.stream.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.35.0-3.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.35.0-3.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"cri-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.35.0-3.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608131626.p2.g7ec2e14.assembly.stream.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608131626.p2.g7ec2e14.assembly.stream.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"ose-aws-ecr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608131626.p2.gb4bad3f.assembly.stream.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"ose-azure-acr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608131626.p2.ga17a3e3.assembly.stream.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.22::el9","package":"ose-gcp-gcr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-202608131626.p2.gea31ab8.assembly.stream.el9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.20::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.13-5.rhaos4.20.git7ebc848.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.20::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.13-5.rhaos4.20.git7ebc848.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.20::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.13-5.rhaos4.20.git7ebc848.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.21::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.11-4.rhaos4.21.git358c4b4.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.21::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.11-4.rhaos4.21.git358c4b4.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.21::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.34.11-4.rhaos4.21.git358c4b4.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.19::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.13-11.rhaos4.19.git089e95c.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.19::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.13-11.rhaos4.19.git089e95c.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.19::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.32.13-11.rhaos4.19.git089e95c.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.13-14.rhaos4.16.git84cfdc6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.13-14.rhaos4.16.git84cfdc6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.13-14.rhaos4.16.git84cfdc6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.13-14.rhaos4.16.git84cfdc6.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.13-14.rhaos4.16.git84cfdc6.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.13-14.rhaos4.16.git84cfdc6.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202608122150.p2.gbbc7c0c.assembly.stream.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202608122150.p2.gd192e90.assembly.stream.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202608122150.p2.gd192e90.assembly.stream.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202608122150.p2.gbbc7c0c.assembly.stream.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202608122150.p2.gbbc7c0c.assembly.stream.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202608122150.p2.gd192e90.assembly.stream.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202608122150.p2.gd192e90.assembly.stream.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202608122150.p2.gbbc7c0c.assembly.stream.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.5-32.rhaos4.13.git1088e36.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.5-32.rhaos4.13.git1088e36.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.5-32.rhaos4.13.git1088e36.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.5-32.rhaos4.13.git1088e36.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.5-32.rhaos4.13.git1088e36.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.5-32.rhaos4.13.git1088e36.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.0-9.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.0-9.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.0-9.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.0-9.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.0-9.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.0-9.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-8.rhaos4.13.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"containernetworking-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-8.rhaos4.13.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"containernetworking-plugins-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-8.rhaos4.13.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.3-7.rhaos4.13.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.3-7.rhaos4.13.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.3-7.rhaos4.13.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.3-7.rhaos4.13.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.3-7.rhaos4.13.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.3-7.rhaos4.13.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.5-36.rhaos4.12.git2e7f657.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.5-36.rhaos4.12.git2e7f657.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.25.5-36.rhaos4.12.git2e7f657.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.13-14.rhaos4.18.gitf2de9ac.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.13-14.rhaos4.18.gitf2de9ac.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.13-14.rhaos4.18.gitf2de9ac.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.13-14.rhaos4.18.gitf2de9ac.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.13-14.rhaos4.18.gitf2de9ac.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.18::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.13-14.rhaos4.18.gitf2de9ac.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.8-22.rhaos4.14.git0633bf1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.8-22.rhaos4.14.git0633bf1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.8-22.rhaos4.14.git0633bf1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.8-22.rhaos4.14.git0633bf1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.8-22.rhaos4.14.git0633bf1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.8-22.rhaos4.14.git0633bf1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.11-17.rhaos4.15.git48e6ddb.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.11-17.rhaos4.15.git48e6ddb.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.11-17.rhaos4.15.git48e6ddb.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.11-17.rhaos4.15.git48e6ddb.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.11-17.rhaos4.15.git48e6ddb.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.15::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28.11-17.rhaos4.15.git48e6ddb.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.14-13.rhaos4.17.git3a25d98.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.14-13.rhaos4.17.git3a25d98.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.14-13.rhaos4.17.git3a25d98.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.14-13.rhaos4.17.git3a25d98.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.14-13.rhaos4.17.git3a25d98.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.14-13.rhaos4.17.git3a25d98.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-10.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-10.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"cri-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-10.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g4e295fa.assembly.stream.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g7189593.assembly.stream.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g7189593.assembly.stream.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g4e295fa.assembly.stream.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"openshift-kube-apiserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g4e295fa.assembly.stream.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"openshift-kube-controller-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g4e295fa.assembly.stream.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"openshift-kube-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g4e295fa.assembly.stream.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"openshift-kubelet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g4e295fa.assembly.stream.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"ose-aws-ecr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609190230.p2.gb0a5486.assembly.stream.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"ose-azure-acr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g5bcfbfd.assembly.stream.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el8","package":"ose-gcp-gcr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g8ce997d.assembly.stream.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-10.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-10.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"cri-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-10.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g4e295fa.assembly.stream.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g7189593.assembly.stream.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g7189593.assembly.stream.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g4e295fa.assembly.stream.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"openshift-kube-apiserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g4e295fa.assembly.stream.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"openshift-kube-controller-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g4e295fa.assembly.stream.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"openshift-kube-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g4e295fa.assembly.stream.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"openshift-kubelet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g4e295fa.assembly.stream.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"ose-aws-ecr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609190230.p2.gb0a5486.assembly.stream.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"ose-azure-acr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g5bcfbfd.assembly.stream.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.17::el9","package":"ose-gcp-gcr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.0-202609081428.p2.g8ce997d.assembly.stream.el9"}]}],"bundled":8}],"products":[{"vendor":"red hat","product":"confidential compute attestation"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.12"},{"vendor":"red hat","product":"red hat openshift container platform 4.13"},{"vendor":"red hat","product":"red hat openshift container platform 4.14"},{"vendor":"red hat","product":"red hat openshift container platform 4.15"},{"vendor":"red hat","product":"red hat openshift container platform 4.16"},{"vendor":"red hat","product":"red hat openshift container platform 4.17"},{"vendor":"red hat","product":"red hat openshift container platform 4.18"},{"vendor":"red hat","product":"red hat openshift container platform 4.19"},{"vendor":"red hat","product":"red hat openshift container platform 4.20"},{"vendor":"red hat","product":"red hat openshift container platform 4.21"},{"vendor":"red hat","product":"red hat openshift container platform 4.22"},{"vendor":"red hat","product":"red hat openshift container platform 5"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:57361","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60444","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60449","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60452","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62548","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65838","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65906","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66385","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67836","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67856","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70585","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15809","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500846","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/cri-o/cri-o/pull/6450","tags":["article"]},{"url":"https://github.com/cri-o/cri-o/pull/6524","tags":["article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15809","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/cve/cve-2022-4318"},{"url":"https://github.com/advisories/GHSA-9gq4-2485-q63q"},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498152","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57361.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15809","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39822","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39822","tags":["advisory"]},{"url":"https://go.dev/cl/797880","tags":["article"]},{"url":"https://go.dev/issue/79005","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4970","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455470","tags":["report"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-112087","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60444.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34986","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34986","tags":["advisory"]},{"url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8","tags":["article"]},{"url":"https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-112086","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60449.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60452.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62548.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2437111","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467820","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65838.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-68121","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68121","tags":["advisory"]},{"url":"https://go.dev/cl/737700","tags":["article"]},{"url":"https://go.dev/issue/77217","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/K09ubi9FQFk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4337","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25679","tags":["advisory"]},{"url":"https://go.dev/cl/752180","tags":["article"]},{"url":"https://go.dev/issue/77578","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4601","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32280","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32280","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32280","tags":["advisory"]},{"url":"https://go.dev/cl/758320","tags":["article"]},{"url":"https://go.dev/issue/78282","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4947","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39820","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39820","tags":["advisory"]},{"url":"https://go.dev/cl/759940","tags":["article"]},{"url":"https://go.dev/issue/78566","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4986","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42499","tags":["advisory"]},{"url":"https://go.dev/cl/771520","tags":["article"]},{"url":"https://go.dev/issue/78987","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4977","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65906.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66385.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67836.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67856.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515840","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70585.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39821","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","tags":["advisory"]},{"url":"https://go.dev/cl/767220","tags":["article"]},{"url":"https://go.dev/issue/78760","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5026","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56859","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","tags":["advisory"]},{"url":"https://go.dev/cl/803320","tags":["article"]},{"url":"https://go.dev/issue/80481","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6088","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-15809","title":"Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env","description":"A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.","status":"published","published":"2026-07-15T12:32:42.587Z","modified":"2026-11-02T17:52:37.696Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-134","CWE-116"],"updated_at":"2026-11-02T19:02:29.283836Z"}],"euvd":[{"id":"EUVD-2026-44661","description":"A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.","status":"published","published":"2026-07-15T12:32:42Z","modified":"2026-11-02T17:52:37Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T05:08:39.228431Z"}],"ghsa":[{"id":"GHSA-9gq4-2485-q63q","title":"A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect,...","description":"A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.","status":"published","published":"2026-07-15T15:33:03Z","modified":"2026-10-01T18:33:37Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-116","CWE-134"],"updated_at":"2026-11-02T15:12:41.196374Z"}],"nvd":[{"id":"CVE-2026-15809","description":"A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.","status":"published","published":"2026-07-15T13:17:03.933Z","modified":"2026-11-02T18:18:53.77Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-134","CWE-116"],"updated_at":"2026-11-02T20:51:40.125089Z"}],"osv":[{"id":"RHSA-2026:57361","title":"Red Hat Security Advisory: OpenShift Container Platform 4.22.11 packages and security update","status":"published","published":"2026-08-26T10:17:34Z","modified":"2026-10-20T10:11:33Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:60444","title":"Red Hat Security Advisory: OpenShift Container Platform 4.20.36 packages and security update","status":"published","published":"2026-09-02T10:21:40Z","modified":"2026-10-16T10:21:19Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:60449","title":"Red Hat Security Advisory: OpenShift Container Platform 4.21.31 packages and security update","status":"published","published":"2026-09-02T10:21:41Z","modified":"2026-10-16T10:21:20Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:60452","title":"Red Hat Security Advisory: OpenShift Container Platform 4.19.45 packages and security update","status":"published","published":"2026-09-03T10:13:48Z","modified":"2026-10-16T10:21:20Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62548","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.70 packages and security update","status":"published","published":"2026-09-10T10:16:08Z","modified":"2026-10-16T10:21:43Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:65838","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.71 packages and security update","status":"published","published":"2026-09-18T10:14:20Z","modified":"2026-10-20T10:13:16Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:65906","title":"Red Hat Security Advisory: OpenShift Container Platform 4.12.98 packages and security update","status":"published","published":"2026-09-17T10:17:23Z","modified":"2026-10-16T10:22:42Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:66385","title":"Red Hat Security Advisory: OpenShift Container Platform 4.18.55 packages and security update","status":"published","published":"2026-09-18T10:14:35Z","modified":"2026-10-16T10:22:49Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67836","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.74 packages and security update","status":"published","published":"2026-09-25T10:14:14Z","modified":"2026-10-16T10:23:19Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67856","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.69 packages and security update","status":"published","published":"2026-09-25T10:14:16Z","modified":"2026-10-16T10:23:20Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:70585","title":"Red Hat Security Advisory: OpenShift Container Platform 4.17.58 packages and security update","status":"published","published":"2026-10-02T10:23:59Z","modified":"2026-10-20T10:14:40Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"AZL-92391","title":"CVE-2026-15809 affecting package cri-o 1.30.1-1","description":"A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.","status":"published","published":"2026-07-15T13:17:03Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:25.880689Z"}]}}