CVE-2020-15157

{"id": "CVE-2020-15157", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.6}]}, "published": "2020-10-16T17:15:11.870", "references": [{"url": "https://github.com/containerd/containerd/releases/tag/v1.2.14", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/containerd/containerd/security/advisories/GHSA-742w-89gc-8m9c", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://usn.ubuntu.com/4589-1/", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://usn.ubuntu.com/4589-2/", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.debian.org/security/2021/dsa-4865", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a \u201cforeign layer\u201d), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources. Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected."}, {"lang": "es", "value": "En containerd (un tiempo de ejecuci\u00f3n de contenedor est\u00e1ndar de la industria) anterior a la versi\u00f3n 1.2.14, Se presenta una vulnerabilidad de filtrado de credenciales. Si un manifiesto de imagen de contenedor en el formato OCI Image o el formato Docker Image V2 Schema 2 incluye una URL para la ubicaci\u00f3n de una capa de imagen espec\u00edfica (tambi\u00e9n se conoce como \u201cforeign layer\u201d), el solucionador de containerd predeterminado seguir\u00e1 esa URL para intentar descargarla. En la versi\u00f3n v1.2.x pero no en 1.3.0 o posterior, el solucionador de containerd predeterminado proporcionar\u00e1 sus credenciales de autenticaci\u00f3n si el servidor donde se encuentra la URL presenta un c\u00f3digo de estado HTTP 401 junto con encabezados HTTP espec\u00edficos del registro. Si un atacante publica una imagen p\u00fablica con un manifiesto que indica que una de las capas se extraiga de un servidor web que controlan y enga\u00f1a a un usuario o sistema para que extraiga la imagen, pueden obtener las credenciales usadas para extraer esa imagen. En algunos casos, puede ser el nombre de usuario y la contrase\u00f1a del usuario para el registro. En otros casos, estas pueden ser las credenciales adjuntas a la instancia virtual en nube que pueden otorgar acceso a otros recursos en nube en la cuenta. El solucionador de containerd predeterminado es usado por el plugin cri-containerd (que puede ser usado por Kubernetes), la herramienta de desarrollo ctr y otros programas cliente que se han vinculado expl\u00edcitamente con \u00e9l. Esta vulnerabilidad ha sido corregida en containerd versi\u00f3n 1.2.14. containerd versi\u00f3n 1.3 y posteriores no est\u00e1n afectados. Si est\u00e1 utilizando containerd versi\u00f3n 1.3 o posterior, no estar\u00e1 afectado. Si est\u00e1 utilizando cri-containerd en la serie 1.2 o anterior, debe asegurarse de obtener solo im\u00e1genes de fuentes confiables. Otros tiempos de ejecuci\u00f3n de contenedores construidos por encima de containerd pero que no usan el solucionador predeterminado (tal y como Docker) no est\u00e1n afectados"}], "lastModified": "2021-11-18T16:16:21.800", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C304363-533E-4DA0-9F40-93E6D86E59CD", "versionEndExcluding": "1.2.14", "versionStartIncluding": "1.2.0"}, {"criteria": "cpe:2.3:a:linuxfoundation:containerd:1.3.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "456DE836-AA57-4EFD-A86C-605C7E3F2458"}, {"criteria": "cpe:2.3:a:linuxfoundation:containerd:1.3.0:beta0:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF7FDBEC-0537-4A66-849D-C713643D2AE0"}, {"criteria": "cpe:2.3:a:linuxfoundation:containerd:1.3.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0B14069-915C-4CA6-BF0C-EC9E8182376F"}, {"criteria": "cpe:2.3:a:linuxfoundation:containerd:1.3.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CCD383CB-954C-42D3-B1A6-7116BA2CA022"}, {"criteria": "cpe:2.3:a:linuxfoundation:containerd:1.3.0:rc0:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E34C93C2-DCBD-4F8A-AE8D-4EDF49CE2BAC"}, {"criteria": "cpe:2.3:a:linuxfoundation:containerd:1.3.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "541DDD1F-302B-41C7-A4EC-362E3AEDEDDF"}, {"criteria": "cpe:2.3:a:linuxfoundation:containerd:1.3.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "023E3733-2DF7-4272-A373-65FE6F1C123D"}, {"criteria": "cpe:2.3:a:linuxfoundation:containerd:1.3.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBF42CAF-4E8D-46ED-9C14-1EFA57721A72"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}