containerd (SUSE:Linux Enterprise Module for Containers 12) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Containers 12 package containerd, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (44)

• CVE-2019-14271 — CVSS 9.8 (critical): In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility…
• CVE-2022-1996 — CVSS 9.1 (critical): Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.
• CVE-2019-5736 — CVSS 8.6 (high): runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and…
• CVE-2021-30465 — CVSS 8.5 (high): runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be…
• CVE-2019-6486 — CVSS 8.2 (high): Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service…
• CVE-2018-16873 — CVSS 8.1 (high): In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag…
• CVE-2018-16874 — CVSS 8.1 (high): In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path…
• CVE-2021-41103 — CVSS 7.8 (high): containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd…
• CVE-2022-23648 — CVSS 7.5 (high): containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1…
• CVE-2021-43565 — CVSS 7.5 (high): The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
• CVE-2016-8867 — CVSS 7.5 (high): Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user…
• CVE-2023-47108 — CVSS 7.5 (high): OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version…
• CVE-2023-45288 — CVSS 7.5 (high): An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames…
• CVE-2023-45142 — CVSS 7.5 (high): OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels…
• CVE-2022-27191 — CVSS 7.5 (high): The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain…
• CVE-2019-13509 — CVSS 7.5 (high): In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode…
• CVE-2019-16884 — CVSS 7.5 (high): runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because…
• CVE-2019-19921 — CVSS 7.0 (high): runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To…
• CVE-2021-21284 — CVSS 6.8 (medium): In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root…
• CVE-2017-14992 — CVSS 6.5 (medium): Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1…
• CVE-2021-21285 — CVSS 6.5 (medium): In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest…
• CVE-2016-9962 — CVSS 6.4 (medium): RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of…
• CVE-2021-41091 — CVSS 6.3 (medium): Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the…
• CVE-2021-21334 — CVSS 6.3 (medium): In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI…
• CVE-2023-25153 — CVSS 6.2 (medium): containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the…
• CVE-2020-15157 — CVSS 6.1 (medium): In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container…
• CVE-2020-13401 — CVSS 6.0 (medium): An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6…
• CVE-2017-16539 — CVSS 5.9 (medium): The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows…
• CVE-2022-24769 — CVSS 5.9 (medium): Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker…
• CVE-2022-29162 — CVSS 5.9 (medium): runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to…
• CVE-2018-16875 — CVSS 5.9 (medium): The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain…
• CVE-2017-8932 — CVSS 5.9 (medium): A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2…
• CVE-2022-23471 — CVSS 5.7 (medium): containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the…
• CVE-2020-12912 — CVSS 5.5 (medium): A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power…
• CVE-2020-8694 — CVSS 5.5 (medium): Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable…
• CVE-2020-8695 — CVSS 5.5 (medium): Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information…
• CVE-2022-31030 — CVSS 5.5 (medium): containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container…
• CVE-2021-41092 — CVSS 5.4 (medium): Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login…
• CVE-2023-25173 — CVSS 5.3 (medium): containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary…
• CVE-2018-10892 — CVSS 5.3 (medium): The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw…
• CVE-2020-15257 — CVSS 5.2 (medium): containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions…
• CVE-2021-32760 — CVSS 5.0 (medium): containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a…
• CVE-2021-41190 — CVSS 3.0 (low): The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI…
• CVE-2021-41089 — CVSS 2.8 (low): Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where…