CVE-2024-3154 — Cri-o: arbitrary command injection via pod annotation

Description (CNA)

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

Affected (CNA)

Vendor / product	Versions
Not supplied / Not supplied	affected 1.27.5; unaffected 1.27.6; affected 1.28.5; unaffected 1.28.6; affected 1.29.3; unaffected 1.29.4; unaffected 1.30.0
Red Hat / Red Hat OpenShift Container Platform 4.12	unaffected 0:1.25.5-16.2.rhaos4.12.gitcb09013.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.13	unaffected 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9 before *
Red Hat / Red Hat OpenShift Container Platform 4.14	unaffected 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9 before *
Red Hat / Red Hat OpenShift Container Platform 4.15	unaffected 0:1.28.6-2.rhaos4.15.git77bbb1c.el8 before *
Red Hat / Red Hat OpenShift Container Platform 3.11	unaffected

CWE

CWE-77

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.