Most recent entries from all

bdu:2022-01715

Withdrawn: BELL-CVE-2022-23648 — CVE-2022-23648 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2024-avi-0199 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2024-avi-0199

CLEANSTART-2025-XK69277 — containerd is a container runtime available as a daemon for Linux and Windows

Affected: CleanStart: containerd

Security vulnerability affects the containerd package. containerd is a container runtime available as a daemon for Linux and Windows.

cnvd-2022-29292

EUVD-2026-13838

fkie_cve-2022-23648

containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. This bug has been fixed in containerd 1.6.1, 1.5.10, and 1.4.12. Users should update to these versions to resolve the issue.

GHSA-crp2-qrr5-8pq7 — containerd CRI plugin: Insecure handling of image volumes

Affected: Go: github.com/containerd/containerd

### Impact

A bug was found in containerd where containers launched through containerd’s CRI implementation with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation.

### Patches

This bug has been fixed in containerd 1.6.1, 1.5.10 and 1.4.13. Users should update to these versions to resolve the issue.

### Workarounds

Ensure that only trusted images are used.

### Credits

The containerd project would like to thank Felix Wilhelm of Google Project Zero for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose) * Email us at [security@containerd.io](mailto:security@containerd.io)

gsd-2022-23648

msrc_CVE-2022-23648 — Insecure handling of image volumes in containerd CRI plugin

msrc_CVE-2022-23648

OESA-2022-1671 — containerd security update

Affected: openEuler:20.03-LTS-SP1: containerd, openEuler:20.03-LTS-SP3: containerd, openEuler:22.03-LTS: containerd

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc.

Security Fix(es):

openSUSE-SU-2022:0720-1 — Security update for containerd

Security update for containerd

SUSE-SU-2022:0719-1 — Security update for containerd

Security update for containerd

UBUNTU-CVE-2022-23648

Affected: Ubuntu:18.04:LTS: containerd, Ubuntu:20.04:LTS: containerd, Ubuntu:22.04:LTS: containerd

WID-SEC-W-2022-1375 — JFrog Artifactory: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszulösen.