{"id":"CVE-2023-25173","aliases":["ALPINE-CVE-2023-25173","ALSA-2023:6473","ALSA-2023:6474","ALSA-2023:6939","AZL-13673","BELL-CVE-2023-25173","DEBIAN-CVE-2023-25173","EUVD-2023-0722","GHSA-hmfx-3pcx-653p","GO-2023-1574","MGASA-2023-0245","OESA-2023-1147","RHSA-2023:3450","RHSA-2023:6473","RHSA-2023:6474","RHSA-2023:6939","RLSA-2023:6939","SUSE-SU-2023:1826-1","SUSE-SU-2023:1827-1","SUSE-SU-2023:4124-1","UBUNTU-CVE-2023-25173","USN-6202-1","openSUSE-SU-2024:12822-1","openSUSE-SU-2024:13295-1","openSUSE-SU-2025:15779-1"],"status":"published","title":"containerd supplementary groups are not set up properly","description":"containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.\n\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\"USER $USERNAME\"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00529,"percentile":0.45199,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269","CWE-863"],"published":"2023-02-16T14:09:12Z","modified":"2026-11-03T06:32:58Z","fixes":[{"ecosystem":"Go","package":"github.com/containerd/containerd","fixed_in":["1.6.18","1.5.18"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.17","package":"containerd","fixed_in":["1.6.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"containerd","fixed_in":["1.6.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"containerd","fixed_in":["1.6.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"containerd","fixed_in":["1.6.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"containerd","fixed_in":["1.6.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"containerd","fixed_in":["1.6.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"containerd","fixed_in":["1.6.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"containerd","fixed_in":["1.6.18-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"moby-containerd","fixed_in":["1.6.18-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"containerd","fixed_in":["1.6.18~ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"containerd","fixed_in":["1.6.18~ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"containerd","fixed_in":["1.6.18~ds1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"containerd","fixed_in":["1.2.6-0ubuntu1~16.04.6+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"containerd","fixed_in":["1.6.12-0ubuntu1~18.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"containerd","fixed_in":["1.6.12-0ubuntu1~20.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"containerd","fixed_in":["1.6.12-0ubuntu1~22.04.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"helm","fixed_in":["3.13.0-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.18"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.18"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.18-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.el9"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.el9"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aardvark-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.7.0-1.module_el8.9.0+3657+d86e192f"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"75-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"conmon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.8-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"container-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.221.0-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.0-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1-54.module_el8.9.0+3673+0c64b403"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1.module_el8.8.0+3615+3543c705"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1.module_el8.8.0+3615+3543c705"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"netavark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.7.0-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-seccomp-bpf-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.9-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.3-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.3-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.4-5.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.4-5.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"udica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.6-20.module_el8.8.0+3615+3543c705"}]}],"bundled":18},{"source":"osv","ecosystem":"Azure Linux:2","package":"moby-containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.18-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.18~ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.18~ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.18~ds1-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.18"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"SEMVER","events":[{"introduced":"1.6.0"},{"fixed":"1.6.18"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.18"},{"introduced":"1.6.0"},{"fixed":"1.6.18"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"golang-github-mrunalp-fileutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-2.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:8","package":"docker-containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.21-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-209.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-209.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-309.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-309.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:serverless:1.0::el8","package":"openshift-serverless-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-3.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.el9"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.el9"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.el9"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.el9"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.el9"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.6.1-5.el9"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aardvark-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.7.0-1.module+el8.9.0+19244+655f84ee"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:75-1.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"conmon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.8-1.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"conmon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.8-1.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"conmon-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.8-1.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"container-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.221.0-1.module+el8.9.0+19685+019f3589"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.0-4.module+el8.9.0+19649+5879504a"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.0-4.module+el8.9.0+19649+5879504a"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.0-4.module+el8.9.0+19649+5879504a"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1-54.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-4.module+el8.9.0+19090+d2921118"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-4.module+el8.9.0+19090+d2921118"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-4.module+el8.9.0+19090+d2921118"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-4.module+el8.9.0+19090+d2921118"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-4.module+el8.9.0+19090+d2921118"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-4.module+el8.9.0+19090+d2921118"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-4.module+el8.9.0+19090+d2921118"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-1.module+el8.9.0+19731+94cfa27e"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"crun-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-1.module+el8.9.0+19731+94cfa27e"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"crun-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-1.module+el8.9.0+19731+94cfa27e"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12-1.module+el8.9.0+19090+d2921118"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12-1.module+el8.9.0+19090+d2921118"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12-1.module+el8.9.0+19090+d2921118"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-1.module+el8.9.0+19244+655f84ee"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libslirp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-1.module+el8.9.0+19244+655f84ee"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libslirp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-1.module+el8.9.0+19244+655f84ee"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libslirp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-1.module+el8.9.0+19244+655f84ee"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"netavark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.7.0-1.module+el8.9.0+19244+655f84ee"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-seccomp-bpf-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-1.module+el8.9.0+19090+d2921118"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-seccomp-bpf-hook-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-1.module+el8.9.0+19090+d2921118"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-seccomp-bpf-hook-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.9-1.module+el8.9.0+19090+d2921118"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-catatonit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-1.module+el8.9.0+19513+83322573"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-4.module+el8.9.0+19090+d2921118"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-1.module+el8.9.0+19513+83322573"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.9-1.module+el8.9.0+19648+0d5ae0ec"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.9-1.module+el8.9.0+19648+0d5ae0ec"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.9-1.module+el8.9.0+19648+0d5ae0ec"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.3-1.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.3-1.module+el8.9.0+19761+326da906"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.module+el8.9.0+19731+94cfa27e"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.module+el8.9.0+19731+94cfa27e"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.module+el8.9.0+19731+94cfa27e"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.99.4-5.module+el8.9.0+19655+b08391f8"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"toolbox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.99.4-5.module+el8.9.0+19655+b08391f8"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"toolbox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.99.4-5.module+el8.9.0+19655+b08391f8"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"toolbox-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.99.4-5.module+el8.9.0+19655+b08391f8"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"udica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.6-20.module+el8.9.0+19244+655f84ee"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-1.module+el8.9.0+1445+07728297"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.19-16.76.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.19-150000.87.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.19-150000.87.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.19-150000.87.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.19-150000.87.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.19-150000.87.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.19-150000.87.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.19-150000.87.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-150000.1.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-150000.1.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-150000.1.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-150000.1.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-150000.1.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-150000.1.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-150000.1.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-150000.1.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-150000.1.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-0ubuntu1~16.04.6+esm4"}]}],"versions":["0.2.1-0ubuntu4~16.04","0.2.3-0ubuntu1~16.04","0.2.5-0ubuntu1~16.04.1","1.2.6-0ubuntu1~16.04.2","1.2.6-0ubuntu1~16.04.3","1.2.6-0ubuntu1~16.04.4","1.2.6-0ubuntu1~16.04.5","1.2.6-0ubuntu1~16.04.6","1.2.6-0ubuntu1~16.04.6+esm1","1.2.6-0ubuntu1~16.04.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12-0ubuntu1~18.04.1+esm1"}]}],"versions":["0.2.5-0ubuntu2","1.2.6-0ubuntu1~18.04.1","1.2.6-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.1","1.3.3-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.3","1.3.3-0ubuntu1~18.04.4","1.4.4-0ubuntu1~18.04.2","1.5.2-0ubuntu1~18.04.1","1.5.2-0ubuntu1~18.04.2","1.5.2-0ubuntu1~18.04.3","1.5.5-0ubuntu3~18.04.1","1.5.5-0ubuntu3~18.04.2","1.5.9-0ubuntu1~18.04.1","1.5.9-0ubuntu1~18.04.2","1.6.12-0ubuntu1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12-0ubuntu1~20.04.3"}]}],"versions":["1.2.10-0ubuntu1","1.3.2-0ubuntu1","1.3.3-0ubuntu1","1.3.3-0ubuntu2","1.3.3-0ubuntu2.1","1.3.3-0ubuntu2.2","1.3.3-0ubuntu2.3","1.4.4-0ubuntu1~20.04.2","1.5.2-0ubuntu1~20.04.1","1.5.2-0ubuntu1~20.04.2","1.5.2-0ubuntu1~20.04.3","1.5.5-0ubuntu3~20.04.1","1.5.5-0ubuntu3~20.04.2","1.5.9-0ubuntu1~20.04.1","1.5.9-0ubuntu1~20.04.4","1.5.9-0ubuntu1~20.04.5","1.5.9-0ubuntu1~20.04.6","1.6.12-0ubuntu1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12-0ubuntu1~22.04.3"}]}],"versions":["1.5.5-0ubuntu3","1.5.9-0ubuntu1","1.5.9-0ubuntu2","1.5.9-0ubuntu3","1.5.9-0ubuntu3.1","1.6.12-0ubuntu1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-0ubuntu1~16.04.6+esm4"}]}],"versions":["0.2.1-0ubuntu4~16.04","0.2.3-0ubuntu1~16.04","0.2.5-0ubuntu1~16.04.1","1.2.6-0ubuntu1~16.04.2","1.2.6-0ubuntu1~16.04.3","1.2.6-0ubuntu1~16.04.4","1.2.6-0ubuntu1~16.04.5","1.2.6-0ubuntu1~16.04.6","1.2.6-0ubuntu1~16.04.6+esm1","1.2.6-0ubuntu1~16.04.6+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12-0ubuntu1~18.04.1+esm1"}]}],"versions":["0.2.5-0ubuntu2","1.2.6-0ubuntu1~18.04.1","1.2.6-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.1","1.3.3-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.3","1.3.3-0ubuntu1~18.04.4","1.4.4-0ubuntu1~18.04.2","1.5.2-0ubuntu1~18.04.1","1.5.2-0ubuntu1~18.04.2","1.5.2-0ubuntu1~18.04.3","1.5.5-0ubuntu3~18.04.1","1.5.5-0ubuntu3~18.04.2","1.5.9-0ubuntu1~18.04.1","1.5.9-0ubuntu1~18.04.2","1.6.12-0ubuntu1~18.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12-0ubuntu1~20.04.3"}]}],"versions":["1.2.10-0ubuntu1","1.3.2-0ubuntu1","1.3.3-0ubuntu1","1.3.3-0ubuntu2","1.3.3-0ubuntu2.1","1.3.3-0ubuntu2.2","1.3.3-0ubuntu2.3","1.4.4-0ubuntu1~20.04.2","1.5.2-0ubuntu1~20.04.1","1.5.2-0ubuntu1~20.04.2","1.5.2-0ubuntu1~20.04.3","1.5.5-0ubuntu3~20.04.1","1.5.5-0ubuntu3~20.04.2","1.5.9-0ubuntu1~20.04.1","1.5.9-0ubuntu1~20.04.4","1.5.9-0ubuntu1~20.04.5","1.5.9-0ubuntu1~20.04.6","1.6.12-0ubuntu1~20.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12-0ubuntu1~22.04.3"}]}],"versions":["1.5.5-0ubuntu3","1.5.9-0ubuntu1","1.5.9-0ubuntu2","1.5.9-0ubuntu3","1.5.9-0ubuntu3.1","1.6.12-0ubuntu1~22.04.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.19-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.2-1.1"}]}],"bundled":20}],"products":[{"vendor":"containerd","product":"containerd"},{"vendor":"linuxfoundation","product":"containerd"}],"references":[{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4","tags":["x_refsource_MISC","x_transferred","Not Applicable","advisory","web"]},{"url":"https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","article"]},{"url":"https://github.com/advisories/GHSA-4wjj-jwc9-2x96","tags":["x_refsource_MISC","x_transferred","Not Applicable","advisory","web"]},{"url":"https://github.com/advisories/GHSA-fjm8-m7m6-2fjp","tags":["x_refsource_MISC","x_transferred","Not Applicable","advisory","web"]},{"url":"https://github.com/advisories/GHSA-phjr-8j92-w5v7","tags":["x_refsource_MISC","x_transferred","Not Applicable","advisory","web"]},{"url":"https://github.com/containerd/containerd/releases/tag/v1.5.18","tags":["x_refsource_MISC","x_transferred","Release Notes","web","article"]},{"url":"https://github.com/containerd/containerd/releases/tag/v1.6.18","tags":["x_refsource_MISC","x_transferred","Release Notes","web","article"]},{"url":"https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25173","tags":["web","advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1574","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI","tags":["web"]},{"url":"https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hmfx-3pcx-653p"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-25173","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6473","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41723","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41724","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41725","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24534","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24536","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24538","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24539","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24540","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25173","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29400","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29406","tags":["report"]},{"url":"https://bugzilla.redhat.com/2174485","tags":["report"]},{"url":"https://bugzilla.redhat.com/2178358","tags":["report"]},{"url":"https://bugzilla.redhat.com/2178488","tags":["report"]},{"url":"https://bugzilla.redhat.com/2178492","tags":["report"]},{"url":"https://bugzilla.redhat.com/2184481","tags":["report"]},{"url":"https://bugzilla.redhat.com/2184482","tags":["report"]},{"url":"https://bugzilla.redhat.com/2184483","tags":["report"]},{"url":"https://bugzilla.redhat.com/2196026","tags":["report"]},{"url":"https://bugzilla.redhat.com/2196027","tags":["report"]},{"url":"https://bugzilla.redhat.com/2196029","tags":["report"]},{"url":"https://bugzilla.redhat.com/2222167","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-6473.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6474","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24537","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3978","tags":["report"]},{"url":"https://bugzilla.redhat.com/2184484","tags":["report"]},{"url":"https://bugzilla.redhat.com/2228689","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-6474.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6939","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3064","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25809","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27561","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28642","tags":["report"]},{"url":"https://bugzilla.redhat.com/2163037","tags":["report"]},{"url":"https://bugzilla.redhat.com/2175721","tags":["report"]},{"url":"https://bugzilla.redhat.com/2182883","tags":["report"]},{"url":"https://bugzilla.redhat.com/2182884","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-6939.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-25173","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25173.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-25173","tags":["advisory"]},{"url":"https://github.com/containerd/containerd","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0245.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31268","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-December/013215.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5776-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/J2URKEEXLEABIVVVLSCXEXL6GIXX3GYN/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/7KYYYEETR5DEGOQBCMLUC4OEN4O3JGKF/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-6202-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1147","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25153","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3450","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.11/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.12/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html/serverless/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2174485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178358","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178488","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178492","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184481","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184482","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184483","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2185511","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3450.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41723","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41723","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vvpx-j8f3-3w6h","tags":["advisory"]},{"url":"https://go.dev/cl/468135","tags":["article"]},{"url":"https://go.dev/cl/468295","tags":["article"]},{"url":"https://go.dev/issue/57855","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1571","tags":["advisory"]},{"url":"https://vuln.go.dev/ID/GO-2023-1571.json","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41724","tags":["advisory"]},{"url":"https://go.dev/cl/468125","tags":["article"]},{"url":"https://go.dev/issue/58001","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1570","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41725","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41725","tags":["advisory"]},{"url":"https://go.dev/cl/468124","tags":["article"]},{"url":"https://go.dev/issue/58006","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1569","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24534","tags":["advisory"]},{"url":"https://go.dev/issue/58975","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24536","tags":["advisory"]},{"url":"https://go.dev/issue/59153","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24537","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24537","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/59180","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24538","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24538","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/59234","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25173","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196026","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196027","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196029","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222167","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6473.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24539","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/59720","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24540","tags":["advisory"]},{"url":"https://go.dev/issue/59721","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29400","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29400","tags":["advisory"]},{"url":"https://go.dev/issue/59722","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29406","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29406","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/2q13H6LEEx0","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180108","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2182485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2182896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2183597","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2183975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2187187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2188340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2223350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2228689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2229644","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230212","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2231975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2233222","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-3132","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-3133","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6474.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3978","tags":["advisory"]},{"url":"https://go.dev/cl/514896","tags":["article"]},{"url":"https://go.dev/issue/61615","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1988","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066138","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2144541","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2163037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2166195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173082","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175721","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175794","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179449","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180118","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2181521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2182052","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2182883","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2182884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2182894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2183041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2183596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2188524","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2189578","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2192977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218315","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2220931","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2229746","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2233218","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-3126","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-3149","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6939.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3064","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6q6q-88xp-6f2r","tags":["advisory"]},{"url":"https://github.com/go-yaml/yaml/commit/f221b8435cfb71e54062f6c6e99e9ade30b124d5","tags":["article"]},{"url":"https://github.com/go-yaml/yaml/releases/tag/v2.2.4","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0956","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25809","tags":["advisory"]},{"url":"https://github.com/opencontainers/runc/commit/0d62b950e60f6980b54fe3bafd9a9c608dc1df17","tags":["article"]},{"url":"https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fc","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27561","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27561","tags":["advisory"]},{"url":"https://gist.github.com/LiveOverflow/c937820b688922eb127fb760ce06dab9","tags":["article"]},{"url":"https://github.com/opencontainers/runc/issues/2197#issuecomment-1437617334","tags":["article"]},{"url":"https://github.com/opencontainers/runc/issues/3751","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28642","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g2j6-57v7-gm8c","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:6939","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231826-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208423","tags":["report"]},{"url":"https://bugzilla.suse.com/1208426","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25173","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231827-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234124-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183043","tags":["report"]},{"url":"https://bugzilla.suse.com/1215588","tags":["report"]},{"url":"https://bugzilla.suse.com/1215711","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-25173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-25153","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-25173","title":"containerd supplementary groups are not set up properly","description":"containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.\n\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\"USER $USERNAME\"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups.","status":"published","published":"2023-02-16T14:09:12.073Z","modified":"2025-03-10T21:10:38.648Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:35:19.959682Z"}],"euvd":[{"id":"EUVD-2023-0722","description":"containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.\n\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\"USER $USERNAME\"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups.","status":"published","published":"2023-02-16T14:09:12Z","modified":"2025-03-10T21:10:38Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:53:09.197707Z"}],"ghsa":[{"id":"GHSA-hmfx-3pcx-653p","title":"Supplementary groups are not set up properly in github.com/containerd/containerd","description":"### Impact\n\nA bug was found in containerd where supplementary groups are not set up properly inside a container.  If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.\n\nDownstream applications that use the containerd client library may be affected as well.\n\n### Patches\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18.  Users should update to these versions and recreate containers to resolve this issue.  Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions.\n\n### Workarounds\n\nEnsure that the `\"USER $USERNAME\"` Dockerfile instruction is not used.  Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups.\n\n### References\n\n- https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/\n- Docker/Moby: CVE-2022-36109, fixed in Docker 20.10.18\n- CRI-O: CVE-2022-2995, fixed in CRI-O 1.25.0\n- Podman: CVE-2022-2989, fixed in Podman 3.0.1 and 4.2.0\n- Buildah: CVE-2022-2990, fixed in Buildah 1.27.1\n\nNote that CVE IDs apply to a particular implementation, even if an issue is common.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)\n* Email us at [security@containerd.io](mailto:security@containerd.io)","status":"published","published":"2023-02-16T14:11:33Z","modified":"2024-09-06T21:37:05Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-269","CWE-863"],"updated_at":"2026-11-02T14:38:01.080229Z"}],"nvd":[{"id":"CVE-2023-25173","description":"containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.\n\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\"USER $USERNAME\"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups.","status":"published","published":"2023-02-16T15:15:20.057Z","modified":"2026-06-17T05:40:50.41Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:07:46.811196Z"}],"osv":[{"id":"ALPINE-CVE-2023-25173","description":"containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.\n\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\"USER $USERNAME\"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups.","status":"published","published":"2023-02-16T15:15:20.057Z","modified":"2026-11-03T06:32:58.945570552Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"AZL-13673","title":"CVE-2023-25173 affecting package moby-containerd for versions less than 1.6.18-2","description":"containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.\n\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\"USER $USERNAME\"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups.","status":"published","published":"2023-02-16T15:15:20Z","modified":"2026-04-21T04:19:14.857746Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"BELL-CVE-2023-25173","title":"CVE-2023-25173 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:29.400259Z","modified":"2026-01-26T09:48:31.2062Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-25173","title":"containerd supplementary groups are not set up properly","description":"containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.\n\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\"USER $USERNAME\"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups.","status":"published","published":"2023-02-16T14:09:12.073Z","modified":"2026-10-28T02:30:38.584061658Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"DEBIAN-CVE-2023-25173","description":"containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.  This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\"USER $USERNAME\"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups.","status":"published","published":"2023-02-16T15:15:20.057Z","modified":"2026-10-26T18:00:36.727362134Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"GHSA-hmfx-3pcx-653p","title":"Supplementary groups are not set up properly in github.com/containerd/containerd","description":"### Impact\n\nA bug was found in containerd where supplementary groups are not set up properly inside a container.  If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.\n\nDownstream applications that use the containerd client library may be affected as well.\n\n### Patches\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18.  Users should update to these versions and recreate containers to resolve this issue.  Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions.\n\n### Workarounds\n\nEnsure that the `\"USER $USERNAME\"` Dockerfile instruction is not used.  Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups.\n\n### References\n\n- https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/\n- Docker/Moby: CVE-2022-36109, fixed in Docker 20.10.18\n- CRI-O: CVE-2022-2995, fixed in CRI-O 1.25.0\n- Podman: CVE-2022-2989, fixed in Podman 3.0.1 and 4.2.0\n- Buildah: CVE-2022-2990, fixed in Buildah 1.27.1\n\nNote that CVE IDs apply to a particular implementation, even if an issue is common.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)\n* Email us at [security@containerd.io](mailto:security@containerd.io)","status":"published","published":"2023-02-16T14:11:33Z","modified":"2026-09-10T03:49:52.072739629Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-269","CWE-863"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"OESA-2023-1147","title":"containerd security update","description":"containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability.  It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc.\r\n\r\nSecurity Fix(es):\r\n\r\ncontainerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.(CVE-2023-25153)\r\n\r\ncontainerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well. This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd\u0026apos;s client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\u0026quot;USER $USERNAME\u0026quot;` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\u0026quot;su\u0026quot;, \u0026quot;-\u0026quot;, \u0026quot;user\u0026quot;]` to allow `su` to properly set up supplementary groups.(CVE-2023-25173)","status":"published","published":"2023-03-04T11:05:37Z","modified":"2026-08-18T01:17:37.350780383Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2023:3450","title":"Red Hat Security Advisory: OpenShift Serverless Client kn 1.29.0 release","status":"published","published":"2024-10-02T00:14:52Z","modified":"2026-10-20T10:01:44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:6473","title":"Red Hat Security Advisory: buildah security update","status":"published","published":"2024-10-02T00:18:35Z","modified":"2026-10-20T10:02:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:6474","title":"Red Hat Security Advisory: podman security, bug fix, and enhancement update","status":"published","published":"2024-10-02T00:18:24Z","modified":"2026-10-20T10:02:12Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:6939","title":"Red Hat Security Advisory: container-tools:rhel8 security and bug fix update","status":"published","published":"2024-10-21T18:35:29Z","modified":"2026-10-20T10:02:16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RLSA-2023:6939","title":"Moderate: container-tools:rhel8 security and bug fix update","description":"The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.\n\nSecurity Fix(es):\n\n* go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)\n\n* golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)\n\n* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)\n\n* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)\n\n* golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)\n\n* golang.org/x/net/html: Cross site scripting (CVE-2023-3978)\n\n* golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)\n\n* golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)\n\n* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)\n\n* golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)\n\n* golang: html/template: improper sanitization of CSS values (CVE-2023-24539)\n\n* containerd: Supplementary groups are not set up properly (CVE-2023-25173)\n\n* runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)\n\n* runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)\n\n* runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration (CVE-2023-28642)\n\n* golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)\n\n* golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.9 Release Notes linked from the References section.","status":"published","published":"2025-11-28T09:04:16.963841Z","modified":"2025-11-28T09:32:49.584987Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2023-25173","description":"containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well. This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\"USER $USERNAME\"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups.","status":"published","published":"2023-02-16T15:15:00Z","modified":"2026-02-04T03:59:13.550294Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"ALSA-2023:6473","title":"Moderate: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. \n\nSecurity Fix(es):\n\n* golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)\n* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)\n* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)\n* golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)\n* golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)\n* golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)\n* golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)\n* golang: html/template: improper sanitization of CSS values (CVE-2023-24539)\n* containerd: Supplementary groups are not set up properly (CVE-2023-25173)\n* golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)\n* golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-07T00:00:00Z","modified":"2026-10-29T11:31:33.925276281Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:6474","title":"Moderate: podman security, bug fix, and enhancement update","description":"The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.\n\nSecurity Fix(es):\n\n* golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)\n* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)\n* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)\n* golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)\n* golang.org/x/net/html: Cross site scripting (CVE-2023-3978)\n* golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)\n* golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)\n* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)\n* golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)\n* golang: html/template: improper sanitization of CSS values (CVE-2023-24539)\n* containerd: Supplementary groups are not set up properly (CVE-2023-25173)\n* golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)\n* golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-07T00:00:00Z","modified":"2026-10-29T11:31:32.066826293Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:6939","title":"Moderate: container-tools:rhel8 security and bug fix update","description":"The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.\n\nSecurity Fix(es):\n\n* go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)\n* golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)\n* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)\n* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)\n* golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)\n* golang.org/x/net/html: Cross site scripting (CVE-2023-3978)\n* golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)\n* golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)\n* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)\n* golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)\n* golang: html/template: improper sanitization of CSS values (CVE-2023-24539)\n* containerd: Supplementary groups are not set up properly (CVE-2023-25173)\n* runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)\n* runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)\n* runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration (CVE-2023-28642)\n* golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)\n* golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:20.02956464Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"GO-2023-1574","title":"Privilege escalation via supplementary groups in github.com/containerd/containerd","description":"Supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases and potentially escalate privileges in the container. Uses of the containerd client library may also have improperly setup supplementary groups.","status":"published","published":"2023-02-17T20:52:58Z","modified":"2026-02-04T04:26:18.468857Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"MGASA-2023-0245","title":"Updated docker-containerd packages fix security vulnerability","description":"Memory leak. (CVE-2022-23471)\nDenial of service with maliciously crafted image with a large file\n(CVE-2023-25153)\nSecurity bypass due to improper supplementary group handling.\n(CVE-2023-25173)\n","status":"published","published":"2023-08-23T19:56:41Z","modified":"2026-04-16T04:43:31.550239061Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12822-1","title":"containerd-1.6.19-1.1 on GA media","description":"These are all security issues fixed in the containerd-1.6.19-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:47:55.359648Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:13295-1","title":"helm-3.13.0-2.1 on GA media","description":"These are all security issues fixed in the helm-3.13.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:24:00.973477Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2025:15779-1","title":"helm3-3.19.2-1.1 on GA media","description":"These are all security issues fixed in the helm3-3.19.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-28T00:00:00Z","modified":"2026-02-04T03:10:43.123465Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"SUSE-SU-2023:1826-1","title":"Security update for containerd","description":"This update for containerd fixes the following issues:\n\nUpdate to containerd v1.6.19:\n\nSecurity fixes:\n    \n- CVE-2023-25153: Fixed OCI image importer memory exhaustion (bnc#1208423).\n- CVE-2023-25173: Fixed supplementary groups not set up properly (bnc#1208426).\n","status":"published","published":"2023-04-13T08:17:43Z","modified":"2026-02-04T03:08:50.639908Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1827-1","title":"Security update for containerd","description":"This update for containerd fixes the following issues:\n\nUpdate to containerd v1.6.19:\n\nSecurity fixes:\n    \n- CVE-2023-25153: Fixed OCI image importer memory exhaustion (bnc#1208423).\n- CVE-2023-25173: Fixed supplementary groups not set up properly (bnc#1208426).\n","status":"published","published":"2023-04-13T08:18:28Z","modified":"2025-05-02T04:34:41.774353Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:4124-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\nhelm was updated to version 3.13.1:\n\n  * Fixing precedence issue with the import of values.\n  * Add missing with clause to release gh action\n  * FIX Default ServiceAccount yaml\n  * fix(registry): unswallow error\n  * remove useless print during prepareUpgrade\n  * fix(registry): address anonymous pull issue\n  * Fix missing run statement on release action\n  * Write latest version to get.helm.sh bucket\n  * Increased release information key name max length.\n\nhelm was updated to version 3.13.0 (bsc#1215588):\n\n  * Fix leaking goroutines in Install\n  * Update Helm to use k8s 1.28.2 libraries\n  * make the dependabot k8s.io group explicit\n  * use dependabot's group support for k8s.io dependencies\n  * doc:Executing helm rollback release 0 will roll back to the\n    previous release\n  * Use labels instead of selectorLabels for pod labels\n  * fix(helm): fix GetPodLogs, the hooks should be sorted before\n    get the logs of each hook\n  * chore: HTTPGetter add default timeout\n  * Avoid nil dereference if passing a nil resolver\n  * Add required changes after merge\n  * Fix #3352, add support for --ignore-not-found just like kubectl\n    delete\n  * Fix helm may identify achieve of the application/x-gzip as\n    application/vnd.ms-fontobject\n  * Restore `helm get metadata` command\n  * Revert 'Add `helm get metadata` command'\n  * test: replace `ensure.TempDir` with `t.TempDir`\n  * use json api url + report curl/wget error on fail\n  * Added error in case try to supply custom label with name of\n    system label during install/upgrade\n  * fix(main): fix basic auth for helm pull or push\n  * cmd: support generating index in JSON format\n  * repo: detect JSON and unmarshal efficiently\n  * Tweaking new dry-run internal handling\n  * bump kubernetes modules to v0.27.3\n  * Remove warning for template directory not found.\n  * Added tests for created OCI annotation time format\n  * Add created OCI annotation\n  * Fix multiple bugs in values handling\n  * chore: fix a typo in `manager.go`\n  * add GetRegistryClient method\n  * oci: add tests for plain HTTP and insecure HTTPS registries\n  * oci: Add flag `--plain-http` to enable working with HTTP\n    registries\n  * docs: add an example for using the upgrade command with\n    existing values\n  * Replace `fmt.Fprintf` with `fmt.Fprint` in get_metadata.go\n  * Replace `fmt.Fprintln` with `fmt.Fprintf` in get_metadata.go\n  * update kubernetes dependencies from v0.27.0 to v0.27.1\n  * Add ClientOptResolver to test util file\n  * Check that missing keys are still handled in tpl\n  * tests: change crd golden file to match after #11870\n  * Adding details on the Factory interface\n  * update autoscaling/v2beta1 to autoscaling/v2 in skeleton chart\n  * feat(helm): add ability for --dry-run to do lookup functions\n    When a helm command is run with the --dry-run flag, it will try\n    to connect to the cluster to be able to render lookup\n    functions. Closes #8137\n  * bugfix:(#11391) helm lint infinite loop  when malformed\n    template object\n  * pkg/engine: fix nil-dereference\n  * pkg/chartutil: fix nil-dereference\n  * pkg/action: fix nil-dereference\n  * full source path when output-dir is not provided\n  * added Contributing.md section and ref link in the README\n  * feat(helm): add ability for --dry-run to do lookup functions\n    When a helm command is run with the --dry-run flag, it will try\n    to connect to the cluster if the value is 'server' to be able\n    to render lookup functions. Closes #8137\n  * feat(helm): add ability for --dry-run to do lookup functions\n  * Add `CHART`, `VERSION` and `APP_VERSION` fields to `get all`\n    command output\n  * Adjust `get` command description to account metadata\n  * add volumes and volumeMounts in chartutil\n  * Seed a default switch to control `automountServiceAccountToken`\n  * Avoid confusing error when passing in '--version X.Y.Z'\n  * Add `helm get metadata` command\n  * Use wrapped error so that ErrNoObjectsVisited can be compared\n    after return.\n  * Add exact version test.\n  * strict file permissions of repository.yaml\n  * Check redefinition of define and include in tpl\n  * Check that `.Template` is passed through `tpl`\n  * Make sure empty `tpl` values render empty.\n  * Pick the test improvement out of PR#8371\n  * #11369 Use the correct index repo cache directory in the\n    `parallelRepoUpdate` method as well\n  * #11369 Add a test case to prove the bug and its resolution\n  * ref(helm): export DescriptorPullSummary fields\n  * feat(helm): add 'ClientOptResolver' ClientOption\n  * Fix flaky TestSQLCreate test by making sqlmock ignore order of\n    sql requests\n  * Fixing tests after adding labels to release fixture\n  * Make default release fixture contain custom labels to make\n    tests check that labels are not lost\n  * Added support for storing custom labels in SQL storage driver\n  * Adding support merging new custom labels with original release\n    labels during upgrade\n  * Added note to install/upgrade commands that original release\n    labels wouldn't be persisted in upgraded release\n  * Added unit tests for implemented install/upgrade labels logic\n  * Remove redudant types from util_test.go\n  * Added tests for newly introduced util.go functions\n  * Fix broken tests for SQL storage driver\n  * Fix broken tests for configmap and secret storage drivers\n  * Make superseded releases keep labels\n  * Support configmap storage driver for install/upgrade actions\n    --labels argument\n  * Added upgrade --install labels argument support\n  * Add labels support for install action with secret storage\n    backend\n  * test: added tests to load plugin from home dir with space\n  * fix: plugin does not load when helm base dir contains space\n  * Add priority class to kind sorter\n  * Fixes #10566\n  * test(search): add mixedCase test case\n  * fix(search): print repo search result in original case\n  * Adjust error message wrongly claiming that there is a resource\n    conflict\n  * Throw an error from jobReady() if the job exceeds its\n    BackoffLimit\n  * github: add Asset Transparency action for GitHub releases\n\nUpdate to version 3.12.3:\n\n* bump kubernetes modules to v0.27.3\n* Add priority class to kind sorter\n\nUpdate to version 3.12.2:\n\n* add GetRegistryClient method\n\nUpdate to version 3.12.1:\n\n  * bugfix:(#11391) helm lint infinite loop  when malformed\n    template object\n  * update autoscaling/v2beta1 to autoscaling/v2 in skeleton chart\n  * test(search): add mixedCase test case\n  * fix(search): print repo search result in original case\n  * strict file permissions of repository.yaml\n  * update kubernetes dependencies from v0.27.0 to v0.27.1\n\nUpdate to version 3.12.0:\n\n  * Attach annotations to OCI artifacts\n  * Fix goroutine leak in action install\n  * fix quiet lint does not fail on non-linting errors\n  * create failing test for quietly linting a chart that doesn't\n    exist\n  * Fixes Readiness Check for statefulsets using partitioned\n    rolling update. (#11774)\n  * fix: failed testcase on windows\n  * Fix 32bit-x86 typo in testsuite\n  * Handle failed DNS case for Go 1.20+\n  * Updating the Go version in go.mod\n  * Fix goroutine leak in perform\n  * Properly invalidate client after CRD install\n  * Provide a helper to set the registryClient in cmd\n  * Reimplemented change in httpgetter for insecure TLS option\n  * Added insecure option to login subcommand\n  * Added support for insecure OCI registries\n  * Enable custom certificates option for OCI\n  * Add testing to default and release branches\n  * Remove job dependency. Should have done when I moved job to new\n    file\n  * Remove check to run only in helm org\n  * Add why comments\n  * Convert remaining CircleCI config to GitHub Actions\n  * Changed how the setup-go action sets go version\n  * chore:Use http constants as http.request parameters\n  * update k8s registry domain\n  * don't mark issues as stale where a PR is in progress\n  * Update to func handling\n  * Add option to support cascade deletion options\n  * the linter varcheck and deadcode are deprecated (since v1.49.0)\n  * Check status code before retrying request\n  * Fix improper use of Table request/response to k8s API\n  * fix template --output-dir issue\n  * Add protection for stack-overflows for nested keys\n  * feature(helm): add --set-literal flag for literal string\n    interpretation\n\nUpdate to version 3.11.3:\n\n  * Fix goroutine leak in perform\n  * Fix goroutine leak in action install\n  * Fix 32bit-x86 typo in testsuite\n  * Fixes Readiness Check for statefulsets using partitioned rolling update. (#11774)\n\n- avoid CGO to workaround missing gold dependency (bsc#1183043)\n","status":"published","published":"2023-10-19T07:33:52Z","modified":"2026-02-04T02:15:17.88032Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"USN-6202-1","title":"containerd vulnerabilities","description":"David Korczynski and Adam Korczynski discovered that containerd\nincorrectly processed certain images with large files. An attacker\ncould possibly use this issue to cause containerd to crash,\nresulting in a denial of service. (CVE-2023-25153)\n\nIt was discovered that containerd incorrectly set up supplementary\ngroups inside a container. An attacker with direct access to the\ncontainer could possibly use this issue to obtain sensitive information\nor execute code with higher privileges. (CVE-2023-25173)\n","status":"published","published":"2023-07-05T10:44:07Z","modified":"2026-06-25T13:32:10.604231276Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}