Published: 25/11/2019 Updated: 28/02/2020

CVSS v2 Base Score: 6 | Impact Score: 6.4 | Exploitability Score: 6.8

CVSS v3 Base Score: 5 | Impact Score: 3.4 | Exploitability Score: 1.6

VMScore: 535

Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P

A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container management (conmon) processes being killed if a workload process triggers an out-of-memory (OOM) condition for the cgroup. An attacker could abuse this flaw to get host network access on an cri-o host.

Vulnerable Product	Search on Vulmon	Subscribe to Product
kubernetes cri-o
fedoraproject fedora -
redhat openshift container platform 3.11
redhat openshift container platform 4.1
redhat openshift container platform 4.2

Synopsis Moderate: OpenShift Container Platform 4236 cri-o security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4236 is now available withupdates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated t ...

Synopsis Moderate: OpenShift Container Platform 311 security update Type/Severity Security Advisory: Moderate Topic An update for atomic-openshift, atomic-openshift-web-console, and cri-o is now available for Red Hat OpenShift Container Platform 311Red Hat Product Security has rated this update as having ...

This is a tutorials for testing OpenShift MachineConfig

Openshift MachineConfig Introduction This is a sample tutorial to test and apply MachineConfig It is motivated by 2 issues: ntp configuration in order to use internal Amazon ntp server crio configuration in order to mitigate the cve-2019-14891 Notice This sample tutorial is based on Openshift 42 (420) on AWS, It should works in other enviroment, but devil reside in th

Cri-o research This research was carried out as part of an internship Summ3r of Hack in Dsec Crio is meant to provide an integration path between OCI conformant runtimes and the kubelet Specifically, it implements the Kubelet Container Runtime Interface (CRI) using OCI conformant runtimes The scope of crio is tied to the scope of the CRI Support multiple image formats in

CWE-754 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14891 https://access.redhat.com/errata/RHSA-2020:2776 https://nvd.nist.gov https://github.com/kanedafromparis/khool-machine-config

CVE-2019-14891

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect