Detections
Analytics

SCA: security update for github.com/containerd/containerd (GHSA-6g2q-w5j3-fwh4)

medium Tenable Cloud Security Plugin ID 434893

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers
 launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container
 client that uses the containerd CRI service) that share the same image may receive incorrect environment
 variables, including values that are defined for other containers. If the affected containers have
 different security contexts, this may allow sensitive information to be unintentionally shared. If you are
 not using containerd's CRI implementation (through one of the mechanisms described above), you are not
 vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same
 image which have different environment variables, you are not vulnerable to this issue. If you are not
 launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced
 likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and
 containerd 1.4.4. Users should update to these versions. (CVE-2021-21334)

See Also

https://github.com/advisories/GHSA-6g2q-w5j3-fwh4

Plugin Details

Severity: Medium

ID: 434893

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 8/20/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 51.16

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2021-21334

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/31/2024

Vulnerability Publication Date: 3/7/2021

Reference Information

CVE: CVE-2021-21334