CVE-2022-3466: Cri-o: security regression of cve-2022-27652
First published: Wed Oct 12 2022(Updated: )
The following cri-o packages as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31 and 4.11.6 included an incorrect version of cri-o that was missing the fix for CVE-2022-27652: - cri-o-1.22.5-10.rhaos4.9.gitd14fede.el8 via RHBA-2022:6316 (<a href="https://access.redhat.com/errata/RHBA-2022:6316">https://access.redhat.com/errata/RHBA-2022:6316</a>) - cri-o-1.23.3-16.rhaos4.10.gitd7c9b35.el8 via RHBA-2022:6257 (<a href="https://access.redhat.com/errata/RHBA-2022:6257">https://access.redhat.com/errata/RHBA-2022:6257</a>) - cri-o-1.24.2-7.rhaos4.11.gitca400e0.el8 via RHBA-2022:6658 (<a href="https://access.redhat.com/errata/RHBA-2022:6658">https://access.redhat.com/errata/RHBA-2022:6658</a>) The regressed <a href="https://access.redhat.com/security/cve/CVE-2022-27652">CVE-2022-27652</a> was previously corrected in Red Hat OpenShift Container Platform 4.9.41 and 4.10.12 via RHBA-2022:5433 and RHSA-2022:1600, respectively. <a href="https://access.redhat.com/security/cve/CVE-2022-3466">CVE-2022-3466</a> was assigned to this security regression and it is specific to the cri-o packages produced by Red Hat. The original issue could allow an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. For more details about the original issue, see: <a href="https://access.redhat.com/security/cve/CVE-2022-27652">https://access.redhat.com/security/cve/CVE-2022-27652</a> <a href="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-27652">https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-27652</a>
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/cri-o | <0:1.25.1-5.rhaos4.12.git6005903.el8 | 0:1.25.1-5.rhaos4.12.git6005903.el8 |
| Kubernetes CRI-O | ||
| Redhat Openshift Container Platform | =3.11 | |
| Redhat Openshift Container Platform | =4.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2022:7398
- https://access.redhat.com/security/cve/CVE-2022-3466
- https://bugzilla.redhat.com/show_bug.cgi?id=2134063
- https://access.redhat.com/errata/RHBA-2022:6316
- https://access.redhat.com/errata/RHBA-2022:6257
- https://access.redhat.com/errata/RHBA-2022:6658
- https://access.redhat.com/security/cve/CVE-2022-27652
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-27652
- https://access.redhat.com/security/cve/cve-2022-3466
- https://www.cve.org/CVERecord?id=CVE-2022-3466 https://nvd.nist.gov/vuln/detail/CVE-2022-3466
Frequently Asked Questions
What is CVE-2022-3466?
CVE-2022-3466 is a vulnerability in the cri-o component of Red Hat OpenShift Container Platform.
How severe is CVE-2022-3466?
CVE-2022-3466 has a severity rating of medium with a CVSS score of 5.3.
Which versions of Red Hat OpenShift Container Platform are affected by CVE-2022-3466?
Red Hat OpenShift Container Platform versions 4.9.48, 4.10.31, and 4.11.6 are affected.
What is the affected component in Red Hat OpenShift Container Platform?
The cri-o component in Red Hat OpenShift Container Platform is affected.
How can I fix CVE-2022-3466 vulnerability?
To fix the CVE-2022-3466 vulnerability, update cri-o to version 1.25.1-5.rhaos4.12.git6005903.el8 or later.
- collector/redhat-cve
- collector/nvd-api
- collector/nvd-index
- agent/author
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-3466
- agent/references
- agent/severity
- agent/weakness
- agent/title
- agent/description
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- package-manager/redhat
- vendor/kubernetes
- canonical/kubernetes cri-o
- vendor/redhat
- canonical/redhat openshift container platform
- version/redhat openshift container platform/3.11
- version/redhat openshift container platform/4.12