CVE-2022-4318: Fedoraproject Extra Packages For Enterprise Linux

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

Affected products

• Fedoraproject Extra Packages For Enterprise Linux: version 8.0 only
• Fedoraproject Fedora: version 36 only; version 37 only
• Kubernetes Cri-O: affected versions not specified
• Red Hat Openshift Container Platform For ARM64: version 4.12 only; version 4.11 only
• Red Hat Openshift Container Platform For Linuxone: version 4.12 only; version 4.11 only
• Red Hat Openshift Container Platform For Power: version 4.12 only; version 4.11 only
• Red Hat Openshift Container Platform IBM Z Systems: version 4.12 only; version 4.11 only

Published 2023-09-25. Last modified 2026-06-17.