6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
6.6 Medium
AI Score
Confidence
Low
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.006 Low
EPSS
Percentile
77.3%
Pulling an intentionally malformed Docker image manifest crashes the dockerd
daemon.
Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.
Maintainers would like to thank Josh Larsen, Ian Coldwater, Duffie Cooley, Rory McCune for working on the vulnerability and Brad Geesaman for responsibly disclosing it to [email protected].
CPE | Name | Operator | Version |
---|---|---|---|
github.com/moby/moby | lt | 20.10.3 | |
github.com/moby/moby | lt | 19.3.15 |
docs.docker.com/engine/release-notes/#20103
github.com/advisories/GHSA-6fj5-m822-rqx8
github.com/moby/moby/commit/8d3179546e79065adefa67cc697c09d0ab137d30
github.com/moby/moby/releases/tag/v19.03.15
github.com/moby/moby/releases/tag/v20.10.3
github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8
nvd.nist.gov/vuln/detail/CVE-2021-21285
security.gentoo.org/glsa/202107-23
security.netapp.com/advisory/ntap-20210226-0005/
www.debian.org/security/2021/dsa-4865
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
6.6 Medium
AI Score
Confidence
Low
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.006 Low
EPSS
Percentile
77.3%