containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.1.0, < 2.1.9CPE matchmatch criteria | cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* | ||
>= 2.2.0, < 2.2.5CPE matchmatch criteria | cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* | ||
>= 2.3.0, < 2.3.2CPE matchmatch criteria | cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.