Security Advisory catalog EUVD-2024-2089 EUVD-2024-2089 Published
Cri-o: malicious container can create symlink on host
cve-program · CVE-2024-5154 Published cri-o https://github.com/cri-o/cri-o
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"versions": [
{
"status": "affected",
"version": "1.30.0",
"lessThan": "1.30.1",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.29.4",
"lessThan": "1.29.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.28.6",
"lessThan": "1.28.7",
"versionType": "semver"
}
],
"packageName": "cri-o",
"collectionURL": "https://github.com/cri-o/cri-o",
"defaultStatus": "unaffected"
} cri-o https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.12",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cri-o",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.25.5-21.2.rhaos4.12.gita3eb75f.el8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.12::el8"
]
} cri-o https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.13",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cri-o",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.26.5-18.2.rhaos4.13.git2e90133.el8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.13::el8",
"cpe:/a:redhat:openshift:4.13::el9"
]
} cri-o https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.14",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cri-o",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.27.7-3.rhaos4.14.git674563e.el8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.14::el8",
"cpe:/a:redhat:openshift:4.14::el9"
]
} cri-o https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.15",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cri-o",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.28.7-2.rhaos4.15.git111aec5.el8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.15::el8",
"cpe:/a:redhat:openshift:4.15::el9"
]
} cri-o https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.16",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cri-o",
"defaultStatus": "affected",
"versions": [
{
"version": "0:1.29.5-7.rhaos4.16.git7db4ada.el8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.16::el8",
"cpe:/a:redhat:openshift:4.16::el9"
]
} kernel https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.16",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "kernel",
"defaultStatus": "affected",
"versions": [
{
"version": "0:5.14.0-427.24.1.el9_4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.16::el8",
"cpe:/a:redhat:openshift:4.16::el9"
]
} openshift https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.16",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift",
"defaultStatus": "affected",
"versions": [
{
"version": "0:4.16.0-202406191607.p0.g58452d8.assembly.stream.el8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.16::el8",
"cpe:/a:redhat:openshift:4.16::el9"
]
} openshift/ose-rhel-coreos-9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.17",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift/ose-rhel-coreos-9",
"defaultStatus": "affected",
"versions": [
{
"version": "417.94.202412040832-0",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.17::el9"
]
} container-tools:rhel8/podman https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-tools:rhel8/podman",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
} conmon https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "conmon",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
} cri-o https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 3.11",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cri-o",
"defaultStatus": "unknown",
"cpes": [
"cpe:/a:redhat:openshift:3.11"
]
} Original source record · Cite this exact observation · Complete original publisher JSON
euvd · EUVD-2024-2089 Published EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields datePublished: Jun 12, 2024, 8:51:43 AM
dateUpdated: Nov 4, 2026, 9:20:01 PM
7 related source bulletins · separate from aliases RHSA-2024:3676: Red Hat Security Advisory: OpenShift Container Platform 4.15.17 security update
CVE-2024-5154
RHSA-2024:4008: Red Hat Security Advisory: OpenShift Container Platform 4.12.60 packages and security update
CVE-2024-5154
RHSA-2024:3700: Red Hat Security Advisory: OpenShift Container Platform 4.14.29 packages and security update
CVE-2024-5154
RHSA-2024:4159: Red Hat Security Advisory: OpenShift Container Platform 4.16.1 packages and security update
CVE-2024-3727 · CVE-2024-5154
RHSA-2024:4486: Red Hat Security Advisory: OpenShift Container Platform 4.13.45 packages and security update
CVE-2024-5154
RHSA-2024:10818: Red Hat Security Advisory: OpenShift Container Platform 4.17.8 security update
CVE-2024-5154 · CVE-2024-6119 · CVE-2024-9341
WID-SEC-W-2024-1362: Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen und Dateimanipulation
CVE-2023-30841 · CVE-2024-5154
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
nvd · CVE-2024-5154 Published NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Modified
Weakness classifications: CWE-22
Original publisher date fields published: 2024-06-12T09:15:19.973
lastModified: 2026-11-04T22:17:22.940
11 source CPE criteria · context only cpe:2.3:a:kubernetes:cri-o:1.28.6:*:*:*:*:*:*:* cpe:2.3:a:kubernetes:cri-o:1.29.4:*:*:*:*:*:*:* cpe:2.3:a:kubernetes:cri-o:1.30.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.13:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.14:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.15:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* The original JSON retains the logical configuration operators, exclusions and version bounds.
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON