containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade containerd | Aug 22, 2024 | Feb 16, 2023 |
| Amazon Linux Ami 2 | — | Upgrade containerd-debuginfoUpgrade containerd-stressUpgrade containerd | Apr 6, 2023 | Feb 16, 2023 |
| Debian | — | Upgrade containerd | Jul 30, 2024 | Feb 16, 2023 |
| Gentoo Linux | — | Upgrade app-containers/containerd. | Aug 7, 2024 | Feb 16, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-engine | May 18, 2023 | Feb 16, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade docker-engine | Jul 5, 2023 | Feb 16, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade docker-engine | Jun 9, 2023 | Feb 16, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade docker-engine | Apr 13, 2023 | Feb 16, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade docker-engine | May 10, 2023 | Feb 16, 2023 |
| Suse | — | Upgrade containerdUpgrade containerd-ctrUpgrade containerd-devel | Apr 14, 2023 | Feb 16, 2023 |
| Ubuntu | — | Upgrade containerd (Ubuntu Pro)Upgrade containerd | Jul 6, 2023 | Feb 16, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 16, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub