{"id":"EUVD-2024-2089","revision":"63ff06d25d1e49febdabeff2f79de28f","records":[{"revision":"63ff06d25d1e49febdabeff2f79de28f","observedAt":"2026-11-07T00:33:22.689+00:00","statement":{"source":"euvd","id":"EUVD-2024-2089","aliases":["CVE-2024-5154","GHSA-j9hf-98c3-wrm8"],"title":"A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.","description":"A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","score":8.1,"severity":null}],"references":["https://access.redhat.com/errata/RHSA-2024:10818","https://access.redhat.com/errata/RHSA-2024:3676","https://access.redhat.com/errata/RHSA-2024:3700","https://access.redhat.com/errata/RHSA-2024:4008","https://access.redhat.com/errata/RHSA-2024:4159","https://access.redhat.com/errata/RHSA-2024:4486","https://access.redhat.com/security/cve/CVE-2024-5154","https://bugzilla.redhat.com/show_bug.cgi?id=2280190","https://github.com/cri-o/cri-o/security/advisories/GHSA-j9hf-98c3-wrm8"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2089","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 12, 2024, 8:51:43 AM","dateUpdated":"Nov 4, 2026, 9:20:01 PM"},"relatedAdvisories":[{"id":"RHSA-2024:3676","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.17 security update","vulnerabilityIds":["CVE-2024-5154"]},{"id":"RHSA-2024:4008","title":"Red Hat Security Advisory: OpenShift Container Platform 4.12.60 packages and security update","vulnerabilityIds":["CVE-2024-5154"]},{"id":"RHSA-2024:3700","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.29 packages and security update","vulnerabilityIds":["CVE-2024-5154"]},{"id":"RHSA-2024:4159","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.1 packages and security update","vulnerabilityIds":["CVE-2024-3727","CVE-2024-5154"]},{"id":"RHSA-2024:4486","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.45 packages and security update","vulnerabilityIds":["CVE-2024-5154"]},{"id":"RHSA-2024:10818","title":"Red Hat Security Advisory: OpenShift Container Platform 4.17.8 security update","vulnerabilityIds":["CVE-2024-5154","CVE-2024-6119","CVE-2024-9341"]},{"id":"WID-SEC-W-2024-1362","title":"Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen und Dateimanipulation","vulnerabilityIds":["CVE-2023-30841","CVE-2024-5154"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2024-2089","identifiers":["EUVD-2024-2089","CVE-2024-5154","GHSA-j9hf-98c3-wrm8"]},"retained":false,"historicalAffected":[]}],"coverage":[]}