GitHub Advisoryadvisory · Go

GHSA-phjr-8j92-w5v7 CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure

HIGH Published 2022-09-20 Modified 2022-09-22 Official page ↗
Aliases
CVE-2022-2995
Ecosystem
Go
Packages
github.com/cri-o/cri-o
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-284, CWE-732
Reviewed
2022-09-21

Affected packages

• Go github.com/cri-o/cri-o: < 1.25.0 → fixed in 1.25.0

Description

Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

Related

Alias · CVE (1)

  • CVE-2022-2995 Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible… vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References