Skip to content
OpenAdvisories
Medium WID-SEC-2022-1002 4 CVEs

Amazon Linux 2: Mehrere Schwachstellen

Published Dec 8, 2021 · Updated Nov 16, 2023 · Revision 9 · de-DE

Vendor: amazon Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Linux Product: Linux 2 Product: Linux 2 plugins Platform: Linux

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in Amazon Linux 2 ausnutzen, um Informationen offenzulegen, Dateien zu manipulieren oder falsche Informationen darzustellen.

Product

Amazon Linux ist eine Linux Distribition, die für Amazon Clouddienste optimiert ist.

Vulnerabilities 4

  • Medium 6.3
    CVE-2021-21334

    environment variable leak

    In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that shar…

    containerd containerd cri-o ctop Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.1
    CVE-2020-15157

    containerd can be coerced into leaking credentials during image pull

    In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific im…

    containerd containerd docker.io docker.io Debian Ubuntu Go
  • Medium 5.0
    CVE-2021-32760

    Archive package allows chmod of file outside of unpack target directory

    containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes…

    containerd containerd ctop containerd Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Low 3.0
    CVE-2021-41190

    Clarify Content-Type handling in OCI spec

    The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during…

    opencontainers distribution-spec buildah docker.io Ubuntu Azure Linux Alpine Go

Revision history

  1. #9

    Neue Updates von Amazon aufgenommen

  2. #8

    Neue Updates von Amazon aufgenommen

  3. #7

    Neue Updates von Red Hat aufgenommen

  4. #6

    Neue Updates von Red Hat aufgenommen

  5. #5

    Neue Updates von SUSE aufgenommen

  6. #4

    Neue Updates von SUSE aufgenommen

  7. #3

    Neue Updates von Red Hat aufgenommen

  8. #2

    Neue Updates von Amazon aufgenommen

  9. #1

    Initiale Fassung

References