REDHAT-BUG-2134063
First published: Wed Oct 12 2022(Updated: )
The following cri-o packages as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31 and 4.11.6 included an incorrect version of cri-o that was missing the fix for CVE-2022-27652: - cri-o-1.22.5-10.rhaos4.9.gitd14fede.el8 via RHBA-2022:6316 (<a href="https://access.redhat.com/errata/RHBA-2022:6316">https://access.redhat.com/errata/RHBA-2022:6316</a>) - cri-o-1.23.3-16.rhaos4.10.gitd7c9b35.el8 via RHBA-2022:6257 (<a href="https://access.redhat.com/errata/RHBA-2022:6257">https://access.redhat.com/errata/RHBA-2022:6257</a>) - cri-o-1.24.2-7.rhaos4.11.gitca400e0.el8 via RHBA-2022:6658 (<a href="https://access.redhat.com/errata/RHBA-2022:6658">https://access.redhat.com/errata/RHBA-2022:6658</a>) The regressed <a href="https://access.redhat.com/security/cve/CVE-2022-27652">CVE-2022-27652</a> was previously corrected in Red Hat OpenShift Container Platform 4.9.41 and 4.10.12 via RHBA-2022:5433 and RHSA-2022:1600, respectively. <a href="https://access.redhat.com/security/cve/CVE-2022-3466">CVE-2022-3466</a> was assigned to this security regression and it is specific to the cri-o packages produced by Red Hat. The original issue could allow an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. For more details about the original issue, see: <a href="https://access.redhat.com/security/cve/CVE-2022-27652">https://access.redhat.com/security/cve/CVE-2022-27652</a> <a href="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-27652">https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-27652</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat OpenShift Container Platform for IBM LinuxONE | ||
| Red Hat cri-o |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHBA-2022:6316
- https://access.redhat.com/errata/RHBA-2022:6257
- https://access.redhat.com/errata/RHBA-2022:6658
- https://access.redhat.com/security/cve/CVE-2022-27652
- https://access.redhat.com/security/cve/CVE-2022-3466
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-27652
- https://access.redhat.com/errata/RHSA-2022:7398
- https://access.redhat.com/security/cve/cve-2022-3466
- https://bugzilla.redhat.com/show_bug.cgi?id=2134063
Frequently Asked Questions
What is the severity of REDHAT-BUG-2134063?
The severity of REDHAT-BUG-2134063 is considered moderate due to the missing fix for CVE-2022-27652 in specific cri-o packages.
How do I fix REDHAT-BUG-2134063?
To fix REDHAT-BUG-2134063, update the affected cri-o packages to the versions that include the fix for CVE-2022-27652.
Which versions of cri-o are affected by REDHAT-BUG-2134063?
The affected versions of cri-o include 1.22.5-10.rhaos4.9.gitd14fede.el8, as released in Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6.
What is CVE-2022-27652 in relation to REDHAT-BUG-2134063?
CVE-2022-27652 is a vulnerability that was not properly fixed in the affected versions of cri-o, leading to potential security risks.
Is there a known workaround for REDHAT-BUG-2134063?
Currently, there are no known workarounds for REDHAT-BUG-2134063 other than applying the necessary updates to the affected packages.
- agent/type
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-3466
- agent/first-publish-date
- agent/source
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat openshift container platform for ibm linuxone
- canonical/red hat cri-o