CVE-2022-1708
Quick assessment
Affected
n/a CRI-O
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CRI-O是一款用于Kubernetes系统的轻量级容器运行时环境。 CRI-O存在资源管理错误漏洞，该漏洞源于CRI-O读取输出缺少大小限制。攻击者可以制造较大的输出来利用该漏洞影响系统的可用性。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-1708
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
CRI-O 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CRI-O是一款用于Kubernetes系统的轻量级容器运行时环境。 CRI-O存在资源管理错误漏洞，该漏洞源于CRI-O读取输出缺少大小限制。攻击者可以制造较大的输出来利用该漏洞影响系统的可用性。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | CRI-O | Affects cri-o <= 1.24.0, 1.23.2, 1.22.4, Fixed-in 1.24.1, 1.23.3, 1.22.5 | - |
|
II. Public POCs for CVE-2022-1708
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-1708
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-1708 (1)
Vendor Advisories for CVE-2022-1708 (1)
-
https://bugzilla.redhat.com/show_bug.cgi?id=2085361 x_refsource_MISC
Same Patch Batch · n/a · 2022-06-07 · 10 CVEs total
| CVE-2022-31470 | Axigen Mobile WebMail 跨站脚本漏洞 | |
| CVE-2022-29564 | Jamf Private Access 安全漏洞 | |
| CVE-2022-25361 | WatchGuard Firebox 安全漏洞 | |
| CVE-2021-37589 | Virtua Cobranca SQL注入漏洞 | |
| CVE-2022-31495 | LibreHealth EHR 跨站脚本漏洞 | |
| CVE-2019-9971 | 3CX Phone 安全漏洞 | |
| CVE-2019-9972 | 3CX Phone 命令注入漏洞 | |
| CVE-2022-29620 | FileZilla 安全漏洞 | |
| CVE-2022-30466 | Joy ebike Wolf 安全漏洞 |
IV. Related Vulnerabilities
Same weakness: CWE-400
-
CVE-2026-82333
multer vulnerable to Denial of Service via oversized array i -
CVE-2026-77037
multer vulnerable to Denial of Service via file descriptor l -
CVE-2026-55247
plone.app.event: Denial of service via iCalendar import -
CVE-2026-55520
Protego: Exponential backtracking ReDoS in robots.txt URL wi -
CVE-2026-55248
plone.app.portlets: Denial of service via RSS feed portlet
V. Comments for CVE-2022-1708
No comments yet