CVE-2021-21285

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.

CVSS v3.0 6.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.5^/10

CVSS v3.0 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://docs.docker.com/engine/release-notes/#20103	Release Notes Vendor Advisory
https://github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8	Third Party Advisory
https://github.com/moby/moby/commit/8d3179546e79065adefa67cc697c09d0ab137d30	Patch Third Party Advisory
https://github.com/moby/moby/releases/tag/v19.03.15	Release Notes Third Party Advisory
https://github.com/moby/moby/releases/tag/v20.10.3	Release Notes Third Party Advisory
https://security.netapp.com/advisory/ntap-20210226-0005/	Third Party Advisory
https://www.debian.org/security/2021/dsa-4865	Third Party Advisory
https://security.gentoo.org/glsa/202107-23	Patch Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:docker:docker::::::::
	cpe:2.3:a:docker:docker::::::::

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*

Information

Published : 2021-02-02 10:15

Updated : 2022-10-25 05:55

NVD link : CVE-2021-21285

Mitre link : CVE-2021-21285

JSON object : View

CWE

CWE-754

Improper Check for Unusual or Exceptional Conditions

Advertisement

Products Affected

debian

debian_linux

netapp

e-series_santricity_os_controller

docker

docker

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://docs.docker.com/engine/release-notes/#20103", "name": "https://docs.docker.com/engine/release-notes/#20103", "tags": ["Release Notes", "Vendor Advisory"], "refsource": "MISC"}, {"url": "https://github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8", "name": "https://github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://github.com/moby/moby/commit/8d3179546e79065adefa67cc697c09d0ab137d30", "name": "https://github.com/moby/moby/commit/8d3179546e79065adefa67cc697c09d0ab137d30", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/moby/moby/releases/tag/v19.03.15", "name": "https://github.com/moby/moby/releases/tag/v19.03.15", "tags": ["Release Notes", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/moby/moby/releases/tag/v20.10.3", "name": "https://github.com/moby/moby/releases/tag/v20.10.3", "tags": ["Release Notes", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://security.netapp.com/advisory/ntap-20210226-0005/", "name": "https://security.netapp.com/advisory/ntap-20210226-0005/", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://www.debian.org/security/2021/dsa-4865", "name": "DSA-4865", "tags": ["Third Party Advisory"], "refsource": "DEBIAN"}, {"url": "https://security.gentoo.org/glsa/202107-23", "name": "GLSA-202107-23", "tags": ["Patch", "Third Party Advisory"], "refsource": "GENTOO"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-754"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-21285", "ASSIGNER": "security-advisories@github.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}}, "publishedDate": "2021-02-02T18:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "20.10.3", "versionStartIncluding": "20.0.0"}, {"cpe23Uri": "cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "19.03.15"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "11.60.3", "versionStartIncluding": "11.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-10-25T12:55Z"}