Skip to content
OpenAdvisories
Medium USN-4589-1 1 CVE

containerd vulnerability

Published Oct 15, 2020 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that containerd could be made to expose sensitive
information when processing URLs in container image manifests. A
remote attacker could use this to trick the user and obtain the
user's registry credentials.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS containerd 1.2.6-0ubuntu1~16.04.4

Vulnerabilities 1

  • Medium 6.1
    CVE-2020-15157

    containerd can be coerced into leaking credentials during image pull

    In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific im…

    containerd containerd docker.io docker.io Debian Ubuntu Go

References

  • report
    https://ubuntu.com/security/CVE-2020-15157