Skip to content
Fencer Vulns
medium 6.5

CVE-2021-21285 json

Docker daemon crash during image pull of malicious image

published 2021-02-02 5 y ago modified 2026-09-10 1 mo ago also EUVD-2024-0271 , GHSA-6fj5-m822-rqx8

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.3%
EPSS 3.3% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.

Patch / fix

  • go github.com/moby/moby 19.3.15, 20.10.3
  • docker docker 19.03.15, 20.10.3
  • docker.io Debian 14, Debian 13, Debian 12 20.10.3+dfsg1-1

debian advisories DEBIAN-CVE-2021-21285

  • docker.io Ubuntu 18.04 LTS 20.10.7-0ubuntu1~18.04.1
  • docker.io Ubuntu 20.04 LTS 20.10.7-0ubuntu1~20.04.1

ubuntu advisories UBUNTU-CVE-2021-21285

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 24.0.9_ce-150000.1.25.1
  • runc SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +14 more 1.0.0~rc93-1.14.2
  • docker SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +13 more 20.10.6_ce-6.49.3
  • containerd SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +13 more 1.4.4-5.32.1
  • runc SLE Module for Containers 12 1.0.0~rc93-16.8.1
  • docker SLE Module for Containers 12 20.10.6_ce-98.66.1
  • containerd SLE Module for Containers 12 1.4.4-16.38.1
  • golang-github-docker-libnetwork SLE Module for Containers 12 0.7.0.1+gitr2908_55e924b8a842-37.1

suse advisories SUSE-SU-2025:03545-1SUSE-SU-2025:03540-1SUSE-SU-2021:1954-1SUSE-SU-2021:1458-1SUSE-SU-2021:0445-1SUSE-SU-2021:0435-1

  • runc openSUSE Leap 15.3 1.0.0~rc93-1.14.2
  • docker openSUSE Leap 15.3 20.10.6_ce-6.49.3
  • containerd openSUSE Leap 15.3 1.4.4-5.32.1
  • runc openSUSE Leap 15.2 1.0.0~rc93-lp152.2.3.1
  • docker openSUSE Leap 15.2 20.10.6_ce-lp152.2.12.1
  • containerd openSUSE Leap 15.2 1.4.4-lp152.2.6.1
  • golang-github-docker-libnetwork openSUSE Leap 15.2 0.7.0.1+gitr2908_55e924b8a842-lp152.2.3.1
  • fish openSUSE Leap 15.2 2.7.1-lp152.5.3.1

opensuse advisories openSUSE-SU-2021:1954-1openSUSE-SU-2021:0878-1openSUSE-SU-2021:0278-1

  • docker Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 20.10.3-r0

alpine advisories ALPINE-CVE-2021-21285

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker Arch Linux 1:20.10.3-1

arch linux advisories AVG-1528

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-21285 updated cvss 6.5

docker: daemon crash during image pull of malicious image

  • Red Hat Enterprise Linux 7 docker
    affected: no fix planned “Out of support scope”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.33% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected packages

ecosystem package affected fixed in
go github.com/moby/moby
<19.3.15
>=20.10.0-beta1, <20.10.3
19.3.15
20.10.3

Affected products

  • moby moby

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-754 Improper Check for Unusual or Exceptional Conditions
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of moby/moby published their own advisory on GitHub. Reviewed sources take precedence over it.