Skip to content
OpenAdvisories
Medium USN-4589-2 1 CVE

docker.io vulnerability

Published Oct 15, 2020 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

USN-4589-1 fixed a vulnerability in containerd. This update provides
the corresponding update for docker.io.

Original advisory details:

It was discovered that containerd could be made to expose sensitive
information when processing URLs in container image manifests. A
remote attacker could use this to trick the user and obtain the
user's registry credentials.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS docker.io 18.09.7-0ubuntu1~16.04.6
Ubuntu · 18.04 LTS 18.04:LTS docker.io 19.03.6-0ubuntu1~18.04.2
Ubuntu · 20.04 LTS 20.04:LTS docker.io 19.03.8-0ubuntu1.20.04.1

Vulnerabilities 1

  • Medium 6.1
    CVE-2020-15157

    containerd can be coerced into leaking credentials during image pull

    In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific im…

    containerd containerd docker.io docker.io Debian Ubuntu Go

References

  • report
    https://ubuntu.com/security/CVE-2020-15157