CVE-2022-1708

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Jun 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-17094.3The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending),CVE-2022-17104.8The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allo CVE-2022-17117.5Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.CVE-2022-17124.3The LiveSync for WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to m CVE-2022-17137.5SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This CVE-2022-17147.1Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented CVE-2022-17159.8Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07.CVE-2022-17164.6Keep My Notes v1.80.147 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to acce CVE-2022-17174.8The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could al CVE-2022-17187.5The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to ca CVE-2022-17195.4Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a ma CVE-2022-17207.8Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the so