Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Cri-o: cri-o path traversal in log handling functions allows arbitrary unmounting (cri-o)

CVE-2025-0750
MEDIUM 6.6

En bref

Source
NVD
EPSS
EPSS 0.27 % · centile 19 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
redhat
Statut NVD
Deferred

Rechercher sur…

Description

A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories.

Faiblesses (CWE)

  • CWE-22 — Traversée de répertoire

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 6.6CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Hredhat
CVSS 3.1MEDIUM 6.6CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:HNVD · secalert@redhat.com (Secondary)

Avis

Références européennes

Produits affectés

ProduitVersions
cri-oaffected 0 < 1.33.1
Red Hat · Red Hat OpenShift Container Platform 4.17unaffected 0:1.30.10-3.rhaos4.17.gitd088fcf.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 2:1.33.7-4.rhaos4.18.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 3:2.1.12-7.rhaos4.18.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 0:0.6.6-0.rhaos4.18.el9.1 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 3:1-86.rhaos4.18.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 4:2.234.2-2.rhaos4.18.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 0:1.31.5-4.rhaos4.18.gitdad78d5.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 0:1.31.1-3.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 0:0.9.3-4.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 0:1.19.1-2.rhaos4.18.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 0:0.16.0-20.gitf6c51c9.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 0:2.8.10-1.rhaos4.17.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 0:2.18.0-6.rhaos4.16.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 0:5.14.0-427.50.2.el9_4 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 0:4.6-3.el9_0.3 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 0:4.18.0-202502051001.p0.gacb9630.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 0:4.18.0-202502110932.p0.gd2acdd5.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 0:4.18.0-202411201308.p0.g006fe4e.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 0:4.18.0-202502032331.p0.ga50d4c0.assembly.stream.el8 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD