PT-2023-1887 · Unknown+7 · Kubernetes Containerd+6

Adam Korczynski + 1 · Publicado 2023-02-16 · Atualizado 2024-09-10 · CVE-2023-25153

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions containerd versions 1.6.17 and earlier, containerd versions 1.5.17 and earlier

Description The issue is related to the import of OCI images in containerd, where there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file could cause a denial of service.

Recommendations Update to containerd version 1.6.18 or later to resolve the issue. Update to containerd version 1.5.18 or later to resolve the issue. As a temporary workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

Exploit

Correção

DoS

Incorrect Authorization

Allocation of Resources Without Limits

Resource Exhaustion

Improper Privilege Management

Enumeração de Fraquezas

CWE-863

CWE-770

CWE-400

CWE-269

Identificadores relacionados

ALT-PU-2023-1480

ALT-PU-2023-5428

ALT-PU-2024-11153

ALT-PU-2024-12206

AZL-13571

AZL-13584

AZL-13674

AZL-35000

BDU:2023-01488

BDU:2023-01489

CVE-2023-25153

GHSA-259W-8HF6-59C2

GO-2023-1573

MGASA-2023-0245

OESA-2023-1147

OPENSUSE-SU-2024:12822-1

RHSA-2026:1536

SUSE-SU-2023:1826-1

SUSE-SU-2023:1827-1

SUSE-SU-2023_1826-1

SUSE-SU-2023_1827-1

USN-6202-1

Produtos afetados

Alt Linux

Astra Linux

Kubernetes Containerd

Linuxmint

Red Os

Suse

Ubuntu

Referências · 62

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25153.json · Exploit
• https://github.com/containerd/containerd · Nota
• https://github.com/containerd/containerd/releases/tag/v1.6.18 · Nota
• https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p · Nota
• https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a · Nota
• https://github.com/containerd/containerd/commit/0c314901076a74a7b797a545d2f462285fdbb8c4 · Correção
• https://github.com/containerd/containerd/releases/tag/v1.5.18 · Nota
• https://github.com/containerd/containerd/security/advisories/GHSA-259w-8hf6-59c2 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-13674 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-13584 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25153 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:12822-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2023:1826-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-25153 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-containerd-cve-2023-25153-cve-2023-25173/?sphrase_id=145370 · Nota