diff --git a/advisories/github-reviewed/2024/11/GHSA-7p9f-6x8j-gxxp/GHSA-7p9f-6x8j-gxxp.json b/advisories/github-reviewed/2024/11/GHSA-7p9f-6x8j-gxxp/GHSA-7p9f-6x8j-gxxp.json new file mode 100644 index 00000000000..0e1d9fba4c3 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-7p9f-6x8j-gxxp/GHSA-7p9f-6x8j-gxxp.json @@ -0,0 +1,115 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7p9f-6x8j-gxxp", + "modified": "2024-11-26T21:50:30Z", + "published": "2024-11-26T21:50:30Z", + "aliases": [ + "CVE-2024-8676" + ], + "summary": "CRI-O: Maliciously structured checkpoint file can gain arbitrary node access", + "details": "### Impact\n\n\n### Patches\n1.31.1, 1.30.6, 1.29.8\n\n### Workarounds\nset `enable_criu_support = false` \n\n### References\n_Are there any links users can visit to find out more?_\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/cri-o/cri-o" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.29.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cri-o/cri-o" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.30.0" + }, + { + "fixed": "1.30.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cri-o/cri-o" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.31.0" + }, + { + "fixed": "1.31.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/cri-o/cri-o/security/advisories/GHSA-7p9f-6x8j-gxxp" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8676" + }, + { + "type": "WEB", + "url": "https://github.com/cri-o/cri-o/commit/e8e7dcb7838d11b5157976bf3e31a5840bb77de7" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-8676" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2313842" + }, + { + "type": "PACKAGE", + "url": "https://github.com/cri-o/cri-o" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-285" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-26T21:50:30Z", + "nvd_published_at": "2024-11-26T20:15:34Z" + } +} \ No newline at end of file