CVE-2023-25153
MEDIUM5.5EPSS 0.24%Memory exhaustion via OCI image importer in github.com/containerd/containerd
發布日:2023/2/16修改日:2026/4/28
描述
containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
受影響套件(3)
- Debian/containerdfrom 0, < 1.4.13~ds1-1~deb11u4
- Go/github.com/containerd/containerdfrom 0, < 1.5.18
- Go/github.com/containerd/containerdfrom 0, < 1.5.18, >= 1.6.0, < 1.6.18
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
參考連結(8)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-25153
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2023-25153
- PATCHhttps://github.com/containerd/containerd
- WEBhttps://github.com/containerd/containerd/commit/0c314901076a74a7b797a545d2f462285fdbb8c4
- WEBhttps://github.com/containerd/containerd/releases/tag/v1.5.18
- WEBhttps://github.com/containerd/containerd/releases/tag/v1.6.18
- WEBhttps://github.com/containerd/containerd/security/advisories/GHSA-259w-8hf6-59c2
- WEBhttps://pkg.go.dev/vuln/GO-2023-1573