x/vulndb: potential Go vuln in github.com/cri-o/cri-o: CVE-2024-5154

[GoVulnBot]

CVE-2024-5154 references github.com/cri-o/cri-o, which may be a Go module.

Description:
A flaw was found in cri-o. A malicious container can create a symbolic link pointing to an arbitrary directory or file on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-5154
• JSON: https://github.com/CVEProject/cvelist/tree/906b06aa895a5c80c93674aaed11ef2f45891169/2024/5xxx/CVE-2024-5154.json
• web: https://access.redhat.com/errata/RHSA-2024:3676
• web: https://access.redhat.com/security/cve/CVE-2024-5154
• web: https://bugzilla.redhat.com/show_bug.cgi?id=2280190
• web: GHSA-j9hf-98c3-wrm8
• Imported by: https://pkg.go.dev/github.com/cri-o/cri-o?tab=importedby

Cross references:

• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: CVE-2022-0811 #354 NOT_IMPORTABLE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: GHSA-w2j5-3rcx-vx7x #363 NOT_IMPORTABLE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: CVE-2022-27652 #426 NOT_IMPORTABLE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: CVE-2022-1708 #480 EFFECTIVELY_PRIVATE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: GHSA-jqmc-79gx-7g8p #608 EFFECTIVELY_PRIVATE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: CVE-2022-2995 #1014 EFFECTIVELY_PRIVATE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: GHSA-cm9x-c3rh-7rc4 #1206 EFFECTIVELY_PRIVATE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: GHSA-p4rx-7wvg-fwrc #2458 EFFECTIVELY_PRIVATE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: CVE-2024-3154 #2791

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/cri-o/cri-o
      vulnerable_at: 1.30.2
      packages:
        - package: Red Hat OpenShift Container Platform 4.15
summary: CVE-2024-5154 in github.com/cri-o/cri-o
cves:
    - CVE-2024-5154
references:
    - web: https://access.redhat.com/errata/RHSA-2024:3676
    - web: https://access.redhat.com/security/cve/CVE-2024-5154
    - web: https://bugzilla.redhat.com/show_bug.cgi?id=2280190
    - web: https://github.com/cri-o/cri-o/security/advisories/GHSA-j9hf-98c3-wrm8
source:
    id: CVE-2024-5154
    created: 2024-06-12T10:01:19.703305263Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/592456 mentions this issue: data/reports: add 19 unreviewed reports

[gopherbot]

Change https://go.dev/cl/592457 mentions this issue: data/reports: add 16 unreviewed reports

[gopherbot]

Change https://go.dev/cl/606359 mentions this issue: data/reports: regenerate 50 reports