Skip to content
Fencer Vulns
medium 6.3

CVE-2021-21334 json

environment variable leak

published 2021-03-10 5 y ago modified 2026-09-10 1 mo ago also GHSA-6g2q-w5j3-fwh4 , EUVD-2024-0272

cvss
6.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.

Patch / fix

  • go github.com/containerd/containerd 1.3.10, 1.4.4
  • linuxfoundation containerd 1.3.10, 1.4.4
  • containerd Debian 14, Debian 13, Debian 12 1.4.4~ds1-1

debian advisories DEBIAN-CVE-2021-21334

  • containerd Ubuntu 18.04 LTS 1.5.2-0ubuntu1~18.04.2
  • containerd Ubuntu 20.04 LTS 1.3.3-0ubuntu2.3

ubuntu advisories UBUNTU-CVE-2021-21334

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • runc SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +14 more 1.0.0~rc93-1.14.2
  • docker SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +13 more 20.10.6_ce-6.49.3
  • containerd SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +13 more 1.4.4-5.32.1
  • runc SLE Module for Containers 12 1.0.0~rc93-16.8.1
  • docker SLE Module for Containers 12 20.10.6_ce-98.66.1
  • containerd SLE Module for Containers 12 1.4.4-16.38.1

suse advisories SUSE-SU-2021:1954-1SUSE-SU-2021:1458-1

  • containerd openSUSE Tumbleweed 1.4.8-2.2
  • runc openSUSE Leap 15.3 1.0.0~rc93-1.14.2
  • docker openSUSE Leap 15.3 20.10.6_ce-6.49.3
  • containerd openSUSE Leap 15.3 1.4.4-5.32.1
  • runc openSUSE Leap 15.2 1.0.0~rc93-lp152.2.3.1
  • docker openSUSE Leap 15.2 20.10.6_ce-lp152.2.12.1
  • containerd openSUSE Leap 15.2 1.4.4-lp152.2.6.1

opensuse advisories openSUSE-SU-2024:10693-1openSUSE-SU-2021:1954-1openSUSE-SU-2021:0878-1

  • k3s Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.20.5.1-r0
  • containerd Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 1.4.4-r0

alpine advisories ALPINE-CVE-2021-21334

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • containerd Arch Linux 1.4.4-1

arch linux advisories AVG-1650

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-21334 updated cvss 6.3

plugin: information leak between containers via environment variables

  • Red Hat Advanced Cluster Management for Kubernetes 2 containerd Red Hat OpenShift Container Platform 4 cri-o, openshift, openshift-clients, openshift-kubelet, openshift-hyperkube, openshift-kube-apiserver, +3 more Red Hat Openshift Container Storage 4 ocs4/cephcsi-rhel8, ocs4/mcg-rhel8-operator, ocs4/ocs-rhel8-operator, ocs4/ocs-must-gather-rhel8, ocs4/rook-ceph-rhel8-operator Red Hat OpenShift Virtualization 2 kubemacpool-container, node-maintenance-operator, virt-cdi-cloner-container, virt-cdi-importer-container, virt-cdi-operator-container, vm-import-virtv2v-container, +13 more Red Hat Quay 3 quay-operator, quay/quay-builder-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.03% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD 3.1 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N
GitHub 3.1 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/containerd/containerd
>=1.4.0, <1.4.4
<1.3.10
1.4.4
1.3.10

Affected products

  • containerd containerd

Classification

Weakness
  • CWE-668 Exposure of Resource to Wrong Sphere
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.