containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| containerd | containerd | < 1.6.38, >= 1.7.0-beta.0, < 1.7.27, >= 2.0.0-beta.0, < 2.0.4 | |
| debian | debian linux | 11.0 | |
| linuxfoundation | containerd | < 1.6.38 |
cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* < 1.6.38cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* ≥ 1.7.0 < 1.7.27cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* ≥ 2.0.0 < 2.0.4cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*Two free tools, one defence: the Sensor catches whoever probes your server; Shield stops known attackers before they reach your site.
Install it and your daily API quota goes to 30,000 lookups — nothing to apply for.