CVE-2021-21285

Опубликовано: 02 фев. 2021

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.

Ссылки

https://docs.docker.com/engine/release-notes/#20103
Release Notes
Vendor Advisory
https://github.com/moby/moby/commit/8d3179546e79065adefa67cc697c09d0ab137d30
Patch
Third Party Advisory
https://github.com/moby/moby/releases/tag/v19.03.15
Release Notes
Third Party Advisory
https://github.com/moby/moby/releases/tag/v20.10.3
Release Notes
Third Party Advisory
https://github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8
Third Party Advisory
https://security.gentoo.org/glsa/202107-23
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210226-0005/
Third Party Advisory
https://www.debian.org/security/2021/dsa-4865
Third Party Advisory
https://docs.docker.com/engine/release-notes/#20103
Release Notes
Vendor Advisory
https://github.com/moby/moby/commit/8d3179546e79065adefa67cc697c09d0ab137d30
Patch
Third Party Advisory
https://github.com/moby/moby/releases/tag/v19.03.15
Release Notes
Third Party Advisory
https://github.com/moby/moby/releases/tag/v20.10.3
Release Notes
Third Party Advisory
https://github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8
Third Party Advisory
https://security.gentoo.org/glsa/202107-23
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210226-0005/
Third Party Advisory
https://www.debian.org/security/2021/dsa-4865
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:*

Версия до 19.03.15 (исключая)

cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:*

Версия от 20.0.0 (включая) до 20.10.3 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*

Версия от 11.0 (включая) до 11.60.3 (включая)

EPSS

Процентиль: 78%

0.01168

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-400

CWE-754

Связанные уязвимости

CVE-2021-21285

CVSS3: 6.5

ubuntu

около 5 лет назад

CVE-2021-21285

CVSS3: 6.5

redhat

около 5 лет назад

CVE-2021-21285

CVSS3: 6.5

msrc

больше 4 лет назад

Описание отсутствует

CVE-2021-21285

CVSS3: 6.5

debian

около 5 лет назад

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in ...

GHSA-6fj5-m822-rqx8

CVSS3: 6.5

github

около 2 лет назад

moby docker daemon crash during image pull of malicious image

EPSS

Процентиль: 78%

0.01168

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-400

CWE-754