GHSA-2cgq-h8xw-2v5j: github.com/cri-o/cri-o fixed in 1.29.4, 1.28.6 and 1.27.6

GHSA-2cgq-h8xw-2v5j PUBLISHED CVSS 7.199999809265137 HIGH

CRI-O vulnerable to an arbitrary systemd property injection

Record from GitHub Advisory Database · Published April 30, 2024

github.com/cri-o/cri-o is fixed in 1.29.4, 1.28.6 and 1.27.6 (Go Modules)

CRI-O vulnerable to an arbitrary systemd property injection

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
github.com/cri-o/cri-o	Go Modules	1.29.4, 1.28.6, 1.27.6
kubernetes-fips-1.28	Chainguard	1.28.15-r9
buildah	Wolfi	1.35.3-r1
grype	Chainguard	0.90.0-r1
neuvector-scanner	Chainguard	0_git20240528-r10
neuvector-scanner	Wolfi	0_git20240528-r10
wolfictl	Wolfi	0.16.6-r1
kubernetes-1.28	Wolfi	1.28.15-r11
cadvisor	Wolfi	0.52.1-r3
kubernetes-fips-1.29	Chainguard	1.29.15-r2
ingress-nginx-controller-fips-1.9	Chainguard	1.9.6-r1
cadvisor	Chainguard	0.52.1-r3

11 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

7.199999809265137

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
chainguard	kubernetes-fips-1.28	0
wolfi	buildah	0
chainguard	grype	0
chainguard	neuvector-scanner	0
wolfi	neuvector-scanner	0
wolfi	wolfictl	0
wolfi	kubernetes-1.28	0
wolfi	cadvisor	0
chainguard	kubernetes-fips-1.29	0
chainguard	ingress-nginx-controller-fips-1.9	0
chainguard	cadvisor	0
chainguard	kubernetes-1.28	0
chainguard	opentelemetry-collector-contrib-fips	0
github.com	cri-o/cri-o	1.28.0, 1.29.0, 0
wolfi	ctop	0
chainguard	wolfictl	0
chainguard	cadvisor-fips	0
chainguard	buildah	0
chainguard	newrelic-infrastructure-agent-1.43	0
chainguard	ctop	0

…and 3 more

Timeline

Apr 30, 2024 CVE Published
Apr 30, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-2cgq-h8xw-2v5j
vulnetix vdb fixes GHSA-2cgq-h8xw-2v5j

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-2cgq-h8xw-2v5j/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →