Detections
Analytics

Alpine: multiple k3s packages: security update to 1.20.5.1-r0

medium Tenable Self-Hosted Container Security Plugin ID 405063

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers
 launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container
 client that uses the containerd CRI service) that share the same image may receive incorrect environment
 variables, including values that are defined for other containers. If the affected containers have
 different security contexts, this may allow sensitive information to be unintentionally shared. If you are
 not using containerd's CRI implementation (through one of the mechanisms described above), you are not
 vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same
 image which have different environment variables, you are not vulnerable to this issue. If you are not
 launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced
 likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and
 containerd 1.4.4. Users should update to these versions. (CVE-2021-21334)

See Also

https://security.alpinelinux.org/vuln/CVE-2021-21334

Plugin Details

Severity: Medium

ID: 405063

Version: Revision 1.27

Type: Local

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 51.16

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2021-21334

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 3/7/2021

Reference Information

CVE: CVE-2021-21334