The vulnerability of Containerd’s execution environment, related to the lack of restrictions on the amount of bytes read for certain files during OCI image import, allows a malicious actor to cause service failures.

🗓️ 23 Mar 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Containerd permits unlimited bytes read during OCI image import, risking service failures.

Reporter	Title	Published	Views	Family All 286
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities found in Java, Node.js and IBM WebSphere Application Server Liberty	13 Mar 202503:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in containerd	17 May 202314:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from shadow-utils, procps-ng, containerd, urllib3, nghttp2 and Golang	15 Dec 202307:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Application Manager 4.5.1 addresses multiple security vulnerabilities	31 May 202322:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOps	26 Mar 202503:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to containerd security bypass and denial of service vulnerabilities( CVE-2023-25173, CVE-2023-25153)	5 Jul 202321:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by two containerd security vulnerabilities (CVE-2023-25153 and CVE-2023-25173)	9 Mar 202316:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to installation failure due to opm ( CVE-2022-41724, CVE-2022-41725, CVE-2022-41723, CVE-2015-3627, CVE-2023-25173, CVE-2023-25153, CVE-2022-23471, CVE-2023-24532 )	6 Jun 202514:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse® on Cloud Pak for Data	19 Apr 202420:11	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	1 Mar 202419:27	–	ibm

Vulners

Node

cloud_native_computing containerdRange<1.5.18

OR

cloud_native_computing containerdRange1.6.0–1.6.18

OR

fedora fedoraMatch36

OR

fedora fedoraMatch37

OR

fedora fedoraMatch38

OR

fedora fedoraMatch39

Source	Link
github	www.github.com/containerd/containerd/releases/tag/v1.5.18
github	www.github.com/containerd/containerd/releases/tag/v1.6.18
github	www.github.com/containerd/containerd/security/advisories/GHSA-259w-8hf6-59c2
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2023021620
bodhi	www.bodhi.fedoraproject.org/updates/FEDORA-2023-aadd08ab96
bodhi	www.bodhi.fedoraproject.org/updates/FEDORA-2023-05b39bc048
bodhi	www.bodhi.fedoraproject.org/updates/FEDORA-2023-cd000ea847
bodhi	www.bodhi.fedoraproject.org/updates/FEDORA-2023-e06549e65c
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-containerd-cve-2023-25153-cve-2023-25173/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2023-25153

27 Apr 2024 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 24.9

CVSS 35.5

EPSS0.00244

containerd execution environment image import vulnerability