A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/cri-o/cri-o(Go) | 1.28.6 | 1.28.7 | N/A |
| github.com/cri-o/cri-o(Go) | 1.29.4 | 1.29.5 | N/A |
| github.com/cri-o/cri-o(Go) | 1.30.0 | 1.30.1 | N/A |
CVSS Metrics
