--- title: "Kubernetes cri-o vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/kubernetes/cri-o type: product description: "Kubernetes cri-o has 10 published CVEs, 0 in CISA KEV and 2 with public exploits." updated: 2024-06-12 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Kubernetes cri-o vulnerabilities Vendor: [Kubernetes](https://radicalnotion.ai/vendor/kubernetes) - **Published CVEs:** 10 - **In CISA KEV:** 0 - **With a public exploit:** 2 - **With a patch:** 10 - **Average CVSS:** 6.8 - **First CVE:** 2018-05-18 - **Latest CVE:** 2024-06-12 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 0 | | High | 6 | | Medium | 4 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-276](https://radicalnotion.ai/cwe/cwe-276) | Incorrect Default Permissions | 2 | | [CWE-269](https://radicalnotion.ai/cwe/cwe-269) | Improper Privilege Management | 1 | | [CWE-284](https://radicalnotion.ai/cwe/cwe-284) | Improper Access Control | 1 | | [CWE-400](https://radicalnotion.ai/cwe/cwe-400) | Uncontrolled Resource Consumption | 1 | | [CWE-460](https://radicalnotion.ai/cwe/cwe-460) | Improper Cleanup on Thrown Exception | 1 | | [CWE-538](https://radicalnotion.ai/cwe/cwe-538) | Insertion of Sensitive Information into Externally-Accessible File or Directory | 1 | | [CWE-732](https://radicalnotion.ai/cwe/cwe-732) | Incorrect Permission Assignment for Critical Resource | 1 | | [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2018 | 1 | | 2019 | 1 | | 2020 | 0 | | 2021 | 0 | | 2022 | 5 | | 2023 | 2 | | 2024 | 1 | ## Affected versions (top 24 of 30) | Version | Kind | CVEs | | --- | --- | --- | | \< 1.16.1 | range | 1 | | \< 1.19.7 | range | 1 | | \< 1.9.0 | range | 1 | | \<= 1.18 | range | 1 | | 1.19.0 \<= v \< 1.19.6 | range | 1 | | 1.20.0 \<= v \< 1.20.7 | range | 1 | | 1.20.0 \<= v \< 1.20.8 | range | 1 | | 1.21.0 \<= v \< 1.21.6 | range | 1 | | 1.21.0 \<= v \< 1.21.8 | range | 1 | | 1.22.0 \<= v \< 1.22.3 | range | 1 | | 1.22.0 \<= v \< 1.22.5 | range | 1 | | 1.23.0 \<= v \< 1.23.2 | range | 1 | | 1.16.1 | patched | 1 | | 1.19.6 | patched | 1 | | 1.19.7 | patched | 1 | | 1.20.7 | patched | 1 | | 1.20.8 | patched | 1 | | 1.21.6 | patched | 1 | | 1.21.8 | patched | 1 | | 1.22.3 | patched | 1 | | 1.22.5 | patched | 1 | | 1.23.2 | patched | 1 | | 1.23.3 | patched | 1 | | 1.9.0 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2024-5154 | Cri-o: malicious container can create symlink on host | high | 8.1 | No | No | Yes | | CVE-2022-4318 | Cri-o: /etc/passwd tampering privesc | high | 7.8 | No | No | Yes | | CVE-2022-3466 | Cri-o: security regression of cve-2022-27652 | medium | 5.3 | No | No | Yes | | CVE-2022-2995 | CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure | high | 7.1 | No | Yes | Yes | | CVE-2022-1708 | Node DOS by way of memory exhaustion through ExecSync request in CRI-O | high | 7.5 | No | Yes | Yes | | CVE-2022-27652 | Incorrect Default Permissions in CRI-O | medium | 5.3 | No | No | Yes | | CVE-2022-0811 | Code Injection in CRI-O | high | 8.8 | No | No | Yes | | CVE-2022-0532 | Incorrect Permission Assignment for Critical Resource in CRI-O | medium | 4.2 | No | No | Yes | | CVE-2019-14891 | - | medium | 5.0 | No | No | Yes | | CVE-2018-1000400 | - | high | 8.8 | No | No | Yes | ## Frequently asked questions ### How many CVEs does Kubernetes cri-o have? Kubernetes cri-o has 10 published CVE records since 2018. ### How many Kubernetes cri-o CVEs are in CISA KEV? None of Kubernetes cri-o's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for Kubernetes cri-o vulnerabilities? Yes — 2 of Kubernetes cri-o's CVEs have a known public exploit. ### Which versions of Kubernetes cri-o are affected? 30 distinct Kubernetes cri-o versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Kubernetes cri-o CVEs? Kubernetes cri-o's CVEs most often map to these CWE weakness types: CWE-276 (Incorrect Default Permissions), CWE-269 (Improper Privilege Management), CWE-284 (Improper Access Control), CWE-400 (Uncontrolled Resource Consumption). ### What is the average severity of Kubernetes cri-o CVEs? The average CVSS base score across Kubernetes cri-o's scored CVEs is 6.8. ## Other products from this vendor - [Kubernetes](https://radicalnotion.ai/vendor/kubernetes/kubernetes) (78 CVEs) - [ingress-nginx](https://radicalnotion.ai/vendor/kubernetes/ingress-nginx) (24 CVEs) - [github.com/kubernetes/kubernetes](https://radicalnotion.ai/vendor/kubernetes/github-com-kubernetes-kubernetes) (9 CVEs) - [Kubelet](https://radicalnotion.ai/vendor/kubernetes/kubelet) (7 CVEs) - [Kubernetes ingress-nginx](https://radicalnotion.ai/vendor/kubernetes/kubernetes-ingress-nginx) (4 CVEs) - [Image Builder](https://radicalnotion.ai/vendor/kubernetes/image-builder) (3 CVEs) - [kube-apiserver](https://radicalnotion.ai/vendor/kubernetes/kube-apiserver) (3 CVEs) - [Minikube](https://radicalnotion.ai/vendor/kubernetes/minikube) (3 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/kubernetes/cri-o). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.