CVE-2021-21334 log

Source
Severity Medium
Remote No
Type Information disclosure
Description
A security issue was found in containerd before version 1.3.10 and 1.4.x before 1.4.4. Containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared.
Group Package Affected Fixed Severity Status Ticket
AVG-1650 containerd 1.4.3-1 1.4.4-1 Medium Fixed
References
https://github.com/containerd/containerd/security/advisories/GHSA-6g2q-w5j3-fwh4
https://github.com/containerd/containerd/issues/5023
https://github.com/containerd/containerd/pull/5024
https://github.com/containerd/containerd/commit/cbcb2f57fbe221986f96b552855eb802f63193de