UBUNTU-CVE-2021-41190

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2021-41190
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-41190.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-41190
Related
Published
2021-11-17T20:15:00Z
Modified
2024-10-15T14:08:25Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.

References

Affected packages

Ubuntu:Pro:16.04:LTS / containerd

Package

Name
containerd
Purl
pkg:deb/ubuntu/containerd?arch=src?distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.2.1-0ubuntu4~16.04
0.2.3-0ubuntu1~16.04
0.2.5-0ubuntu1~16.04.1

1.*

1.2.6-0ubuntu1~16.04.2
1.2.6-0ubuntu1~16.04.3
1.2.6-0ubuntu1~16.04.4
1.2.6-0ubuntu1~16.04.5
1.2.6-0ubuntu1~16.04.6
1.2.6-0ubuntu1~16.04.6+esm1
1.2.6-0ubuntu1~16.04.6+esm2
1.2.6-0ubuntu1~16.04.6+esm4

Ecosystem specific 

{
    "ubuntu_priority": "low"
}

Ubuntu:Pro:16.04:LTS / docker.io

Package

Name
docker.io
Purl
pkg:deb/ubuntu/docker.io?arch=src?distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.6.2~dfsg1-1ubuntu4
1.10.2-0ubuntu3
1.10.2-0ubuntu4
1.10.3-0ubuntu1
1.10.3-0ubuntu4
1.10.3-0ubuntu5
1.10.3-0ubuntu6
1.11.2-0ubuntu5~16.04
1.12.1-0ubuntu13~16.04.1
1.12.3-0ubuntu4~16.04.2
1.12.6-0ubuntu1~16.04.1
1.13.1-0ubuntu1~16.04.2

17.*

17.03.2-0ubuntu2~16.04.1

18.*

18.06.1-0ubuntu1~16.04.2
18.06.1-0ubuntu1.2~16.04.1
18.09.2-0ubuntu1~16.04.1
18.09.5-0ubuntu1~16.04.2
18.09.7-0ubuntu1~16.04.1
18.09.7-0ubuntu1~16.04.4
18.09.7-0ubuntu1~16.04.5
18.09.7-0ubuntu1~16.04.6
18.09.7-0ubuntu1~16.04.7

Ecosystem specific 

{
    "ubuntu_priority": "low"
}

Ubuntu:18.04:LTS / containerd

Package

Name
containerd
Purl
pkg:deb/ubuntu/containerd?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.9-0ubuntu1~18.04.1

Affected versions

0.*

0.2.5-0ubuntu2

1.*

1.2.6-0ubuntu1~18.04.1
1.2.6-0ubuntu1~18.04.2
1.3.3-0ubuntu1~18.04.1
1.3.3-0ubuntu1~18.04.2
1.3.3-0ubuntu1~18.04.3
1.3.3-0ubuntu1~18.04.4
1.4.4-0ubuntu1~18.04.2
1.5.2-0ubuntu1~18.04.1
1.5.2-0ubuntu1~18.04.2
1.5.2-0ubuntu1~18.04.3
1.5.5-0ubuntu3~18.04.1
1.5.5-0ubuntu3~18.04.2

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1.5.9-0ubuntu1~18.04.1",
            "binary_name": "containerd"
        },
        {
            "binary_version": "1.5.9-0ubuntu1~18.04.1",
            "binary_name": "containerd-dbgsym"
        },
        {
            "binary_version": "1.5.9-0ubuntu1~18.04.1",
            "binary_name": "golang-github-containerd-containerd-dev"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / docker.io

Package

Name
docker.io
Purl
pkg:deb/ubuntu/docker.io?arch=src?distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.13.1-0ubuntu6

17.*

17.03.2-0ubuntu1
17.03.2-0ubuntu3
17.03.2-0ubuntu5
17.12.1-0ubuntu1

18.*

18.06.1-0ubuntu1~18.04.1
18.06.1-0ubuntu1.2~18.04.1
18.09.2-0ubuntu1~18.04.1
18.09.5-0ubuntu1~18.04.2
18.09.7-0ubuntu1~18.04.1
18.09.7-0ubuntu1~18.04.3
18.09.7-0ubuntu1~18.04.4

19.*

19.03.6-0ubuntu1~18.04.1
19.03.6-0ubuntu1~18.04.2
19.03.6-0ubuntu1~18.04.3

20.*

20.10.2-0ubuntu1~18.04.2
20.10.2-0ubuntu1~18.04.3
20.10.7-0ubuntu1~18.04.1
20.10.7-0ubuntu1~18.04.2
20.10.7-0ubuntu5~18.04.2
20.10.7-0ubuntu5~18.04.3
20.10.12-0ubuntu2~18.04.1
20.10.21-0ubuntu1~18.04.2
20.10.21-0ubuntu1~18.04.3

Ecosystem specific 

{
    "ubuntu_priority": "low"
}

Ubuntu:20.04:LTS / containerd

Package

Name
containerd
Purl
pkg:deb/ubuntu/containerd?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.9-0ubuntu1~20.04.4

Affected versions

1.*

1.2.10-0ubuntu1
1.3.2-0ubuntu1
1.3.3-0ubuntu1
1.3.3-0ubuntu2
1.3.3-0ubuntu2.1
1.3.3-0ubuntu2.2
1.3.3-0ubuntu2.3
1.4.4-0ubuntu1~20.04.2
1.5.2-0ubuntu1~20.04.1
1.5.2-0ubuntu1~20.04.2
1.5.2-0ubuntu1~20.04.3
1.5.5-0ubuntu3~20.04.1
1.5.5-0ubuntu3~20.04.2
1.5.9-0ubuntu1~20.04.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1.5.9-0ubuntu1~20.04.4",
            "binary_name": "containerd"
        },
        {
            "binary_version": "1.5.9-0ubuntu1~20.04.4",
            "binary_name": "containerd-dbgsym"
        },
        {
            "binary_version": "1.5.9-0ubuntu1~20.04.4",
            "binary_name": "golang-github-containerd-containerd-dev"
        }
    ]
}

Ubuntu:22.04:LTS / containerd

Package

Name
containerd
Purl
pkg:deb/ubuntu/containerd?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.9-0ubuntu1

Affected versions

1.*

1.5.5-0ubuntu3

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1.5.9-0ubuntu1",
            "binary_name": "containerd"
        },
        {
            "binary_version": "1.5.9-0ubuntu1",
            "binary_name": "containerd-dbgsym"
        },
        {
            "binary_version": "1.5.9-0ubuntu1",
            "binary_name": "golang-github-containerd-containerd-dev"
        }
    ]
}