containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
CVSS Details
- CVSS 3.1 Base Score: 6.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade containerd | Aug 22, 2024 | Feb 16, 2023 |
| Amazon Linux Ami 2 | — | Upgrade containerdUpgrade containerd-debuginfoUpgrade containerd-stress | Apr 6, 2023 | Feb 16, 2023 |
| Debian | — | Upgrade containerd | Jul 30, 2024 | Feb 16, 2023 |
| Gentoo Linux | — | Upgrade app-containers/containerd. | Aug 7, 2024 | Feb 16, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-engine | May 18, 2023 | Feb 16, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-engine | Jul 5, 2023 | Feb 16, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade docker-engine | Jun 9, 2023 | Feb 16, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade docker-engine | Apr 13, 2023 | Feb 16, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade docker-engine | May 10, 2023 | Feb 16, 2023 |
| Suse | — | Upgrade containerdUpgrade containerd-ctrUpgrade containerd-devel | Apr 14, 2023 | Feb 16, 2023 |
| Ubuntu | — | Upgrade containerdUpgrade containerd (Ubuntu Pro) | Jul 6, 2023 | Feb 16, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 16, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub