CVE-2023-25153
Publication date 16 February 2023
Last updated 24 July 2024
Ubuntu priority
containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| containerd | ||
| 22.04 LTS jammy |
Fixed 1.6.12-0ubuntu1~22.04.3
|
|
| 20.04 LTS focal |
Fixed 1.6.12-0ubuntu1~20.04.3
|
|
| 18.04 LTS bionic |
Fixed 1.6.12-0ubuntu1~18.04.1+esm1
|
|
| 16.04 LTS xenial |
Fixed 1.2.6-0ubuntu1~16.04.6+esm4
|
|
| 14.04 LTS trusty | Ignored end of standard support |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProSeverity score breakdown
| Parameter | Value |
|---|---|
| Base score |
5.5 · Medium
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-6202-1
- containerd vulnerabilities
- 5 July 2023