{"id":"CVE-2021-21334","aliases":["ALPINE-CVE-2021-21334","AZL-44910","AZL-81209","BELL-CVE-2021-21334","DEBIAN-CVE-2021-21334","EUVD-2024-0272","GHSA-6g2q-w5j3-fwh4","MGASA-2021-0248","SUSE-SU-2021:1458-1","SUSE-SU-2021:1954-1","UBUNTU-CVE-2021-21334","USN-4881-1","openSUSE-SU-2021:0878-1","openSUSE-SU-2021:1954-1","openSUSE-SU-2024:10693-1"],"status":"published","title":"environment variable leak","description":"In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01947,"percentile":0.8047,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-668"],"published":"2021-03-05T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Go","package":"github.com/containerd/containerd","fixed_in":["1.4.4","1.3.10"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.12","package":"containerd","fixed_in":["1.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"containerd","fixed_in":["1.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"containerd","fixed_in":["1.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"containerd","fixed_in":["1.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"containerd","fixed_in":["1.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"containerd","fixed_in":["1.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"containerd","fixed_in":["1.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"containerd","fixed_in":["1.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"containerd","fixed_in":["1.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"containerd","fixed_in":["1.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"containerd","fixed_in":["1.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"containerd","fixed_in":["1.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"containerd","fixed_in":["1.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"k3s","fixed_in":["1.20.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"k3s","fixed_in":["1.20.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"k3s","fixed_in":["1.20.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"k3s","fixed_in":["1.20.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"k3s","fixed_in":["1.20.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"k3s","fixed_in":["1.20.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"k3s","fixed_in":["1.20.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"k3s","fixed_in":["1.20.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"k3s","fixed_in":["1.20.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"k3s","fixed_in":["1.20.5.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"k3s","fixed_in":["1.20.5.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"containerd","fixed_in":["1.4.4~ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"containerd","fixed_in":["1.4.4~ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"containerd","fixed_in":["1.4.4~ds1-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"docker-containerd","fixed_in":["1.4.4-1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"docker-containerd","fixed_in":["1.4.4-1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"containerd","fixed_in":["1.5.2-0ubuntu1~18.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"containerd","fixed_in":["1.3.3-0ubuntu2.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"k3s","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"k3s","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"k3s","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"k3s","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"k3s","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"k3s","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"k3s","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"k3s","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"k3s","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"k3s","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"k3s","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-preview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.27.0~preview2-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4~ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4~ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4~ds1-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"SEMVER","events":[{"introduced":"1.4.0"},{"fixed":"1.4.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.10"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"docker-containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"docker-containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.mga8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-16.38.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-98.66.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-16.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP2","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP2","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP2","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP3","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.1-0ubuntu4~16.04","0.2.3-0ubuntu1~16.04","0.2.5-0ubuntu1~16.04.1","1.2.6-0ubuntu1~16.04.2","1.2.6-0ubuntu1~16.04.3","1.2.6-0ubuntu1~16.04.4","1.2.6-0ubuntu1~16.04.5","1.2.6-0ubuntu1~16.04.6","1.2.6-0ubuntu1~16.04.6+esm1","1.2.6-0ubuntu1~16.04.6+esm2","1.2.6-0ubuntu1~16.04.6+esm4","1.2.6-0ubuntu1~16.04.6+esm5","1.2.6-0ubuntu1~16.04.6+esm6","1.2.6-0ubuntu1~16.04.6+esm7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-0ubuntu1~18.04.2"}]}],"versions":["0.2.5-0ubuntu2","1.2.6-0ubuntu1~18.04.1","1.2.6-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.1","1.3.3-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.3","1.3.3-0ubuntu1~18.04.4","1.4.4-0ubuntu1~18.04.2","1.5.2-0ubuntu1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-0ubuntu2.3"}]}],"versions":["1.2.10-0ubuntu1","1.3.2-0ubuntu1","1.3.3-0ubuntu1","1.3.3-0ubuntu2","1.3.3-0ubuntu2.1","1.3.3-0ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-0ubuntu2.3"}]}],"versions":["1.2.10-0ubuntu1","1.3.2-0ubuntu1","1.3.3-0ubuntu1","1.3.3-0ubuntu2","1.3.3-0ubuntu2.1","1.3.3-0ubuntu2.2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-lp152.2.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-lp152.2.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-lp152.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-5.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-6.49.3"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-1.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-2.2"}]}],"bundled":9}],"products":[{"vendor":"containerd","product":"containerd"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"linuxfoundation","product":"containerd"}],"references":[{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-6g2q-w5j3-fwh4","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/containerd/containerd/releases/tag/v1.4.4","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/containerd/containerd/releases/tag/v1.3.10","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/containerd/containerd/commit/05f951a3781f4f2c1911b05e61c160e9c30eaa8e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUE2Z2ZUWBHRU36ZGBD2YSJCYB6ELPXE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIBPKSX5IOWPM3ZPFB3JVLXWDHSZTTWT/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VTXHA5JOWQRCCUZH7ZQBEYN6KZKJEYSD/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202105-33","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21334","tags":["web","advisory"]},{"url":"https://github.com/containerd/cri/pull/1628","tags":["web"]},{"url":"https://github.com/containerd/cri/pull/1629","tags":["web"]},{"url":"https://github.com/containerd/containerd/commit/2d9c8aa4b3f4313982c5c999af57212a1c5d144b","tags":["web"]},{"url":"https://github.com/containerd/containerd/commit/cbcb2f57fbe221986f96b552855eb802f63193de","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUE2Z2ZUWBHRU36ZGBD2YSJCYB6ELPXE/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QIBPKSX5IOWPM3ZPFB3JVLXWDHSZTTWT/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VTXHA5JOWQRCCUZH7ZQBEYN6KZKJEYSD/"},{"url":"https://github.com/advisories/GHSA-6g2q-w5j3-fwh4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-21334","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-21334","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-21334","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUE2Z2ZUWBHRU36ZGBD2YSJCYB6ELPXE","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QIBPKSX5IOWPM3ZPFB3JVLXWDHSZTTWT","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VTXHA5JOWQRCCUZH7ZQBEYN6KZKJEYSD","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2021-0248.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29003","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/KUE2Z2ZUWBHRU36ZGBD2YSJCYB6ELPXE/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211458-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1028638","tags":["report"]},{"url":"https://bugzilla.suse.com/1034053","tags":["report"]},{"url":"https://bugzilla.suse.com/1048046","tags":["report"]},{"url":"https://bugzilla.suse.com/1051429","tags":["report"]},{"url":"https://bugzilla.suse.com/1053532","tags":["report"]},{"url":"https://bugzilla.suse.com/1095817","tags":["report"]},{"url":"https://bugzilla.suse.com/1118897","tags":["report"]},{"url":"https://bugzilla.suse.com/1118898","tags":["report"]},{"url":"https://bugzilla.suse.com/1118899","tags":["report"]},{"url":"https://bugzilla.suse.com/1121967","tags":["report"]},{"url":"https://bugzilla.suse.com/1131314","tags":["report"]},{"url":"https://bugzilla.suse.com/1131553","tags":["report"]},{"url":"https://bugzilla.suse.com/1149954","tags":["report"]},{"url":"https://bugzilla.suse.com/1152308","tags":["report"]},{"url":"https://bugzilla.suse.com/1160452","tags":["report"]},{"url":"https://bugzilla.suse.com/1168481","tags":["report"]},{"url":"https://bugzilla.suse.com/1175081","tags":["report"]},{"url":"https://bugzilla.suse.com/1175821","tags":["report"]},{"url":"https://bugzilla.suse.com/1181594","tags":["report"]},{"url":"https://bugzilla.suse.com/1181641","tags":["report"]},{"url":"https://bugzilla.suse.com/1181677","tags":["report"]},{"url":"https://bugzilla.suse.com/1181730","tags":["report"]},{"url":"https://bugzilla.suse.com/1181732","tags":["report"]},{"url":"https://bugzilla.suse.com/1181749","tags":["report"]},{"url":"https://bugzilla.suse.com/1182451","tags":["report"]},{"url":"https://bugzilla.suse.com/1182476","tags":["report"]},{"url":"https://bugzilla.suse.com/1182947","tags":["report"]},{"url":"https://bugzilla.suse.com/1183024","tags":["report"]},{"url":"https://bugzilla.suse.com/1183397","tags":["report"]},{"url":"https://bugzilla.suse.com/1183855","tags":["report"]},{"url":"https://bugzilla.suse.com/1184768","tags":["report"]},{"url":"https://bugzilla.suse.com/1184962","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21334","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211954-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185405","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30465","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-21334","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4881-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21334","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G76UZ7FY6VFG73EC6UUCBE46L3TAKR6G/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OX775QFGRPXXX7W5FDFKP3V5KCNZYD7F/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32760","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-21334","title":"environment variable leak","description":"In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.","status":"published","published":"2021-03-10T21:30:18Z","modified":"2024-08-03T18:09:15.415Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:33:00.488332Z"}],"euvd":[{"id":"EUVD-2024-0272","description":"In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.","status":"published","published":"2021-03-10T21:30:18Z","modified":"2024-08-03T18:09:15Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:25:06.347262Z"}],"ghsa":[{"id":"GHSA-6g2q-w5j3-fwh4","title":"containerd environment variable leak","description":"## Impact\n\nContainers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers.  If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared.\n\nIf you are not using containerd’s CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue.\n\nIf you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue.\n\nIf you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue\n\n## Patches\n\nThis vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4.  Users should update to these versions as soon as they are released.\n\n## Workarounds\n\nThere are no known workarounds.\n\n## For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Open an issue](https://github.com/containerd/containerd/issues/new/choose)\n* Email us at security@containerd.io if you think you’ve found a security bug.","status":"published","published":"2024-01-31T23:22:45Z","modified":"2024-01-31T23:22:47Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-668"],"updated_at":"2026-11-02T14:37:34.405364Z"}],"nvd":[{"id":"CVE-2021-21334","description":"In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.","status":"published","published":"2021-03-10T22:15:12.183Z","modified":"2026-06-17T03:35:19.197Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:06:50.805771Z"}],"osv":[{"id":"ALPINE-CVE-2021-21334","description":"In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.","status":"published","published":"2021-03-10T22:15:12.183Z","modified":"2026-11-03T06:32:27.243614994Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"AZL-44910","title":"CVE-2021-21334 affecting package cri-o 1.30.1-1","description":"In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.","status":"published","published":"2021-03-10T22:15:12Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"AZL-81209","title":"CVE-2021-21334 affecting package kata-containers-preview 3.27.0~preview2-2","description":"In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.","status":"published","published":"2021-03-10T22:15:12Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"BELL-CVE-2021-21334","title":"CVE-2021-21334 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:01.79022Z","modified":"2026-01-26T09:47:35.433615Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-21334","description":"In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.","status":"published","published":"2021-03-10T22:15:12.183Z","modified":"2026-10-20T10:53:33.563103732Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"DEBIAN-CVE-2021-21334","description":"In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.","status":"published","published":"2021-03-10T22:15:12.183Z","modified":"2026-10-23T18:04:49.188777006Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-6g2q-w5j3-fwh4","title":"containerd environment variable leak","description":"## Impact\n\nContainers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers.  If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared.\n\nIf you are not using containerd’s CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue.\n\nIf you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue.\n\nIf you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue\n\n## Patches\n\nThis vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4.  Users should update to these versions as soon as they are released.\n\n## Workarounds\n\nThere are no known workarounds.\n\n## For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Open an issue](https://github.com/containerd/containerd/issues/new/choose)\n* Email us at security@containerd.io if you think you’ve found a security bug.","status":"published","published":"2024-01-31T23:22:45Z","modified":"2026-09-10T03:50:04.845087799Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-668"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"UBUNTU-CVE-2021-21334","description":"In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.","status":"published","published":"2021-03-05T00:00:00Z","modified":"2026-06-25T19:15:14.517229838Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"MGASA-2021-0248","title":"Updated docker-containerd packages fix security vulnerability","description":"In containerd (an industry-standard container runtime) before versions 1.3.10 \nand 1.4.4, containers launched through containerd's CRI implementation \n(through Kubernetes, crictl, or any other pod/container client that uses the \ncontainerd CRI service) that share the same image may receive incorrect \nenvironment variables, including values that are defined for other \ncontainers. If the affected containers have different security contexts, this \nmay allow sensitive information to be unintentionally shared. If you are not \nusing containerd's CRI implementation (through one of the mechanisms \ndescribed above), you are not vulnerable to this issue. If you are not \nlaunching multiple containers or Kubernetes pods from the same image which \nhave different environment variables, you are not vulnerable to this issue. \nIf you are not launching multiple containers or Kubernetes pods from the same \nimage in rapid succession, you have reduced likelihood of being vulnerable to \nthis issue This vulnerability has been fixed in containerd 1.3.10 and \ncontainerd 1.4.4. (CVE-2021-21334).\n","status":"published","published":"2021-06-13T21:32:39Z","modified":"2026-04-16T04:41:28.666821905Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0878-1","title":"Security update for containerd, docker, runc","description":"This update for containerd, docker, runc fixes the following issues:\n\nDocker was updated to 20.10.6-ce (bsc#1184768, bsc#1182947, bsc#1181594)\n\n* Switch version to use -ce suffix rather than _ce to avoid confusing other\n  tools (bsc#1182476).\n* CVE-2021-21284: Fixed a potential privilege escalation when the root user in \n  the remapped namespace has access to the host filesystem (bsc#1181732)\n* CVE-2021-21285: Fixed an issue where pulling a malformed Docker image manifest \n  crashes the dockerd daemon (bsc#1181730). \n* btrfs quotas being removed by Docker regularly (bsc#1183855, bsc#1175081)\n\nrunc was updated to v1.0.0~rc93 (bsc#1182451, bsc#1175821 bsc#1184962).\n\n* Use the upstream runc package (bsc#1181641, bsc#1181677, bsc#1175821).\n* Fixed /dev/null is not available (bsc#1168481).\n* CVE-2021-30465: Fixed a symlink-exchange attack vulnarability (bsc#1185405).\n\ncontainerd was updated to v1.4.4\n\n* CVE-2021-21334: Fixed a potential information leak through environment variables (bsc#1183397).\n* Handle a requirement from docker (bsc#1181594).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-06-16T13:54:13Z","modified":"2026-02-04T04:35:55.587998Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1954-1","title":"Security update for containerd, docker, runc","description":"This update for containerd, docker, runc fixes the following issues:\n\nDocker was updated to 20.10.6-ce (bsc#1184768, bsc#1182947, bsc#1181594)\n\n* Switch version to use -ce suffix rather than _ce to avoid confusing other\n  tools (bsc#1182476).\n* CVE-2021-21284: Fixed a potential privilege escalation when the root user in \n  the remapped namespace has access to the host filesystem (bsc#1181732)\n* CVE-2021-21285: Fixed an issue where pulling a malformed Docker image manifest \n  crashes the dockerd daemon (bsc#1181730). \n* btrfs quotas being removed by Docker regularly (bsc#1183855, bsc#1175081)\n\nrunc was updated to v1.0.0~rc93 (bsc#1182451, bsc#1175821 bsc#1184962).\n\n* Use the upstream runc package (bsc#1181641, bsc#1181677, bsc#1175821).\n* Fixed /dev/null is not available (bsc#1168481).\n* CVE-2021-30465: Fixed a symlink-exchange attack vulnarability (bsc#1185405).\n\ncontainerd was updated to v1.4.4\n\n* CVE-2021-21334: Fixed a potential information leak through environment variables (bsc#1183397).\n* Handle a requirement from docker (bsc#1181594).\n","status":"published","published":"2021-07-10T13:50:39Z","modified":"2026-02-04T04:02:49.849359Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:10693-1","title":"containerd-1.4.8-2.2 on GA media","description":"These are all security issues fixed in the containerd-1.4.8-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:33:56.633182Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:1458-1","title":"Security update for containerd, docker, runc","description":"This update for containerd, docker, runc fixes the following issues:\n\n- Docker was updated to 20.10.6-ce\n  *  Switch version to use -ce suffix rather than _ce to avoid confusing other\n     tools (bsc#1182476).\n  * CVE-2021-21284: Fixed a potential privilege escalation when the root user in \n    the remapped namespace has access to the host filesystem (bsc#1181732)\n  * CVE-2021-21285: Fixed an issue where pulling a malformed Docker image manifest \n    crashes the dockerd daemon (bsc#1181730). \n\n- runc was updated to  v1.0.0~rc93 (bsc#1182451 and bsc#1184962).\n  * Use the upstream runc package (bsc#1181641, bsc#1181677, bsc#1175821).\n  * Fixed /dev/null is not available (bsc#1168481).\n  * Fixed an issue where podman hangs when spawned by salt-minion process (bsc#1149954).\n  * CVE-2019-19921: Fixed a race condition with shared mounts (bsc#1160452).\n  * CVE-2019-16884: Fixed an LSM bypass via malicious Docker image that mount \n    over a /proc directory (bsc#1152308).\n  * CVE-2019-5736: Fixed potential write attacks to the host runc binary (bsc#1121967).\n  * Fixed an issue where after a kernel-update docker doesn't run (bsc#1131314 bsc#1131553)\n  * Ensure that we always include the version information in runc (bsc#1053532).\n  \n- Switch to Go 1.13 for build.\n  * CVE-2018-16873: Fixed a potential remote code execution (bsc#1118897).\n  * CVE-2018-16874: Fixed a directory traversal in 'go get' via curly braces \n    in import paths (bsc#1118898).\n  * CVE-2018-16875: Fixed a CPU denial of service (bsc#1118899).\n  * Fixed an issue with building containers (bsc#1095817).\n\n- containerd was updated to v1.4.4\n  * CVE-2021-21334: Fixed a potential information leak through environment variables (bsc#1183397).\n  * Handle a requirement from docker (bsc#1181594).\n  * Install the containerd-shim* binaries and stop creating (bsc#1183024).\n  * update version to the one required by docker (bsc#1034053)\n\n- Use -buildmode=pie for tests and binary build (bsc#1048046, bsc#1051429)\n- Cleanup seccomp builds similar (bsc#1028638).\n- Update to handle the docker-runc removal, and drop the -kubic flavour (bsc#1181677, bsc#1181749)\n","status":"published","published":"2021-04-30T10:58:51Z","modified":"2026-02-04T02:16:12.876879Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1954-1","title":"Security update for containerd, docker, runc","description":"This update for containerd, docker, runc fixes the following issues:\n\nDocker was updated to 20.10.6-ce (bsc#1184768, bsc#1182947, bsc#1181594)\n\n* Switch version to use -ce suffix rather than _ce to avoid confusing other\n  tools (bsc#1182476).\n* CVE-2021-21284: Fixed a potential privilege escalation when the root user in \n  the remapped namespace has access to the host filesystem (bsc#1181732)\n* CVE-2021-21285: Fixed an issue where pulling a malformed Docker image manifest \n  crashes the dockerd daemon (bsc#1181730). \n* btrfs quotas being removed by Docker regularly (bsc#1183855, bsc#1175081)\n\nrunc was updated to v1.0.0~rc93 (bsc#1182451, bsc#1175821 bsc#1184962).\n\n* Use the upstream runc package (bsc#1181641, bsc#1181677, bsc#1175821).\n* Fixed /dev/null is not available (bsc#1168481).\n* CVE-2021-30465: Fixed a symlink-exchange attack vulnarability (bsc#1185405).\n\ncontainerd was updated to v1.4.4\n\n* CVE-2021-21334: Fixed a potential information leak through environment variables (bsc#1183397).\n* Handle a requirement from docker (bsc#1181594).\n","status":"published","published":"2021-06-11T08:45:35Z","modified":"2026-02-04T02:46:11.35992Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4881-1","title":"containerd vulnerability","description":"It was discovered that containerd incorrectly handled certain environment\nvariables. Contrary to expectations, a container could receive environment\nvariables defined for a different container, possibly containing sensitive\ninformation.\n","status":"published","published":"2021-03-17T12:59:01Z","modified":"2026-04-27T15:50:11.380424Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}