CVE-2021-21334 - log back

CVE-2021-21334 edited at 05 Mar 2021 13:43:26
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Local
Type
- Unknown
+ Information disclosure
Description
+ A security issue was found in containerd before version 1.3.10 and 1.4.x before 1.4.4. Containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared.
References
+ https://github.com/containerd/containerd/security/advisories/GHSA-6g2q-w5j3-fwh4
+ https://github.com/containerd/containerd/issues/5023
+ https://github.com/containerd/containerd/pull/5024
+ https://github.com/containerd/containerd/commit/cbcb2f57fbe221986f96b552855eb802f63193de
Notes
CVE-2021-21334 created at 05 Mar 2021 13:36:28