5
CVSSv3

CVE-2021-41190

Published: 17/11/2021 Updated: 07/11/2023
CVSS v2 Base Score: 4 | Impact Score: 2.9 | Exploitability Score: 8
CVSS v3 Base Score: 5 | Impact Score: 1.4 | Exploitability Score: 3.1
VMScore: 356
Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N

Vulnerability Summary

In the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header. Versions of Moby (Docker Engine) before 20.10.11 and versions of containerd before 1.4.12 and 1.5.8 treat the Content-Type header as trusted and deserialize the document according to that header. If the Content-Type header changed between pulls of the same ambiguous document (with the same digest), the document may be interpreted differently, meaning that the digest alone is insufficient to unambiguously identify the content of the image. (CVE-2021-41190)

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

linuxfoundation open container initiative image format specification

linuxfoundation open container initiative distribution specification

fedoraproject fedora 34

fedoraproject fedora 35

Vendor Advisories

In the OCI Distribution Specification version 100 and prior and in the OCI Image Specification version 101 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header Versions of Moby (Docker Engine) prior to 201011 and versions of containerd prior to 1412 and 158 treat the Content-Type header a ...
Synopsis Moderate: ACS 370 enhancement and security update Type/Severity Security Advisory: Moderate Topic Updated images are now available for Red Hat Advanced Cluster Security forKubernetes (RHACS) The updated image includes bug fixes and featureimprovementsRed Hat Product Security has rated this update as having a security impact of Mod ...
Synopsis Moderate: OpenShift API for Data Protection (OADP) 101 security and bug fix update Type/Severity Security Advisory: Moderate Topic OpenShift API for Data Protection (OADP) 101 is now availableRed Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System (CVSS) base s ...
Synopsis Important: Red Hat Advanced Cluster Management 25 security updates, images, and bug fixes Type/Severity Security Advisory: Important Topic Red Hat Advanced Cluster Management for Kubernetes 250 is now generally availableRed Hat Product Security has rated this update as having a security impactof Important A Common Vulnerability ...
Synopsis Moderate: OpenShift Container Platform 4124 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4124 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security impact of ...
Synopsis Moderate: OpenShift Container Platform 4103 bug fix and security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Container Platform release 4103 is now available withupdates to package ...
Synopsis Moderate: OpenShift Virtualization 4101 Images security and bug fix update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Virtualization release 4101 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a securit ...
Synopsis Moderate: Migration Toolkit for Containers (MTC) 171 security and bug fix update Type/Severity Security Advisory: Moderate Topic The Migration Toolkit for Containers (MTC) 171 is now availableRed Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System (CVSS) base s ...
Synopsis Important: OpenShift Container Platform 4110 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 4110 is now available withupdates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Co ...
Synopsis Moderate: OpenShift Container Platform 4103 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4103 is now available withupdates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security impact of ...
Synopsis Moderate: container-tools:rhel8 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linu ...
Synopsis Moderate: Red Hat Advanced Cluster Management 243 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 243 General Availability release images This update provides security fixes, bug fixes, and updates the container imagesRed Hat Product Security has ...
Synopsis Moderate: Migration Toolkit for Containers (MTC) 154 security update Type/Severity Security Advisory: Moderate Topic The Migration Toolkit for Containers (MTC) 154 is now availableRed Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System (CVSS) base score, whichg ...
The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content In the OCI Distribution Specification version 100 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations Documents that contain both “manifests” and ...
In the OCI Distribution Specification version 100 and prior and in the OCI Image Specification version 101 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header Versions of Moby (Docker Engine) prior to 201011 and versions of containerd prior to 1412 and 158 treat the Content-Type header a ...
In the OCI Distribution Specification version 100 and prior and in the OCI Image Specification version 101 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header Versions of Moby (Docker Engine) prior to 201011 and versions of containerd prior to 1412 and 158 treat the Content-Type header a ...
The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content In the OCI Image Specification, the manifest and index documents were not self-describing and documents with a single digest could be interpreted as either a manifest or an index In the OCI Image Specification version 101 there is ...
The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content In the OCI Image Specification, the manifest and index documents were not self-describing and documents with a single digest could be interpreted as either a manifest or an index In the OCI Image Specification version 101 there is ...
In the OCI Distribution Specification version 100 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header If a ...