CVE-2021-21334— containerd 安全漏洞
一分钟漏洞结论
影响对象
containerd containerd
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
containerd是美国阿帕奇（Apache）基金会的一个容器守护进程。该进程根据 RunC OCI 规范负责控制宿主机上容器的完整周期。 containerd before versions 1.3.10 and 1.4.4 存在安全漏洞，该漏洞允许共享敏感信息。
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2021-21334 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
environment variable leak
来源: CVE Program / CVE List V5
Vulnerability Description
In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
将资源暴露给错误范围
来源: CVE Program / CVE List V5
Vulnerability Title
containerd 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
containerd是美国阿帕奇（Apache）基金会的一个容器守护进程。该进程根据 RunC OCI 规范负责控制宿主机上容器的完整周期。 containerd before versions 1.3.10 and 1.4.4 存在安全漏洞，该漏洞允许共享敏感信息。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| containerd | containerd | < 1.3.10 | - |
|
二、漏洞 CVE-2021-21334 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2021-21334 的情报信息
请登录查看更多情报信息。
CVE-2021-21334 补丁与修复 (1)
CVE-2021-21334 厂商安全公告 (2)
-
https://github.com/containerd/containerd/security/advisories/GHSA-6g2q-w5j3-fwh4 x_refsource_CONFIRM
-
CVE-2021-21334 邮件列表归档 (3)
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VTXHA5JOWQRCCUZH7ZQBEYN6KZKJEYSD/ vendor-advisory x_refsource_FEDORA
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUE2Z2ZUWBHRU36ZGBD2YSJCYB6ELPXE/ vendor-advisory x_refsource_FEDORA
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIBPKSX5IOWPM3ZPFB3JVLXWDHSZTTWT/ vendor-advisory x_refsource_FEDORA
CVE-2021-21334 其他参考 (2)
-
https://github.com/containerd/containerd/releases/tag/v1.3.10 x_refsource_MISC
-
https://github.com/containerd/containerd/releases/tag/v1.4.4 x_refsource_MISC
IV. Related Vulnerabilities
V. Comments for CVE-2021-21334
暂无评论