CVE-2020-15257 containerd-shim API Exposed to Host Network Containers

🗓️ 01 Dec 2020 02:30:16Reported by GitHub_MType

CVE-2020-15257 containerd-shim API Exposed to Host Network Containers. Access controls improperly verified, allowing malicious containers to run processes with elevated privileges. Vulnerability fixed in containerd 1.3.9 and 1.4.3

Reporter	Title	Published	Views	Family All 115
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by a containerd security vulnerability (CVE-2020–15257)	18 Dec 202015:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to an issue in OPM and Golang Go packages (CVE-2020-15257, CVE-2021-21334 and CVE-2021-41771)	8 Jul 202207:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to assorted vulnerabilities in Grafana	19 Jul 202421:46	–	ibm
ATTACKERKB	CVE-2020-15257	1 Dec 202000:00	–	attackerkb
Tenable Nessus	Amazon Linux 2 : containerd (ALASECS-2023-030)	16 Nov 202300:00	–	nessus
Tenable Nessus	Amazon Linux AMI : containerd, containerd-stress (ALAS-2020-1455)	30 Nov 202000:00	–	nessus
Tenable Nessus	Debian DSA-4865-1 : docker.io - security update	1 Mar 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : kata-containers (EulerOS-SA-2021-1245)	5 Feb 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : kata-containers (EulerOS-SA-2021-1264)	5 Feb 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP5 : docker-engine (EulerOS-SA-2022-1886)	17 Jun 202200:00	–	nessus

[
  {
    "product": "containerd",
    "vendor": "containerd",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.3.9"
      },
      {
        "status": "affected",
        "version": ">= 1.4.0, < 1.4.3"
      }
    ]
  }
]

Source	Link
github	www.github.com/containerd/containerd/releases/tag/v1.4.3
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNKXLOLZWO5FMAPX63ZL7JNKTNNT5NQD/
github	www.github.com/containerd/containerd/security/advisories/GHSA-36xw-fx78-c5r4
security	www.security.gentoo.org/glsa/202105-33
debian	www.debian.org/security/2021/dsa-4865
github	www.github.com/containerd/containerd/commit/4a4bb851f5da563ff6e68a83dc837c7699c469ad

26 May 2021 11:08Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.15.2

EPSS0.03236

CWE-669