Alpine: multiple containerd packages: security update to 1.4.3-r0 (deprecated)

medium Tenable Cloud Security Plugin ID 400265

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers
launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container
client that uses the containerd CRI service) that share the same image may receive incorrect environment
variables, including values that are defined for other containers. If the affected containers have
different security contexts, this may allow sensitive information to be unintentionally shared. If you are
not using containerd's CRI implementation (through one of the mechanisms described above), you are not
vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same
image which have different environment variables, you are not vulnerable to this issue. If you are not
launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced
likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and
containerd 1.4.4. Users should update to these versions. (CVE-2021-21334)

Plugin Details

Severity: Medium

ID: 400265

Version: Revision 1.23

Type: Local

Family: Alpine Linux Local Security Checks

Published: 8/16/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 51.16

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2021-21334

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/7/2021

Vulnerability Publication Date: 3/7/2021

Reference Information

CVE: CVE-2021-21334

Detections

Analytics