Detections
Analytics

Alpine: multiple containerd packages: security update to 1.5.7-r0

high Tenable Cloud Security Plugin ID 403896

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - containerd is an open source container runtime with an emphasis on simplicity, robustness and portability.
 A bug was found in containerd where container root directories and some plugins had insufficiently
 restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and
 execute programs. When containers included executable programs with extended permission bits (such as
 setuid), unprivileged Linux users could discover and execute those programs. When the UID of an
 unprivileged Linux user on the host collided with the file owner or group inside a container, the
 unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has
 been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are
 released and may restart containers or update directory permissions to mitigate the vulnerability. Users
 unable to update should limit access to the host to trusted users. Update directory permission on
 container bundles directories. (CVE-2021-41103)

See Also

https://security.alpinelinux.org/vuln/CVE-2021-41103

Plugin Details

Severity: High

ID: 403896

Version: Revision 1.27

Type: Local

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2021-41103

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/4/2021

Reference Information

CVE: CVE-2021-41103