Skip to content
Fencer Vulns
medium 6.1

CVE-2020-15157 json

containerd can be coerced into leaking credentials during image pull

published 2020-10-16 6 y ago modified 2026-09-10 1 mo ago also GHSA-742w-89gc-8m9c , GO-2022-0803 , EUVD-2022-0879

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.3%
EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits
0
none known

Summary

In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a “foreign layer”), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources. Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected.

Patch / fix

  • go github.com/containerd/containerd 1.2.14
  • linuxfoundation containerd 1.2.14
  • docker.io Debian 14, Debian 13, Debian 12 19.03.13+dfsg2-1
  • containerd Debian 14, Debian 13, Debian 12 1.3.2~ds1-2

debian advisories DEBIAN-CVE-2020-15157

  • docker.io Ubuntu 16.04 LTS 18.09.7-0ubuntu1~16.04.6
  • docker.io Ubuntu 18.04 LTS 19.03.6-0ubuntu1~18.04.2
  • docker.io Ubuntu 20.04 LTS 19.03.8-0ubuntu1.20.04.1
  • containerd Ubuntu 16.04 LTS 1.2.6-0ubuntu1~16.04.4

ubuntu advisories UBUNTU-CVE-2020-15157

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cri-o openshift 4.7 1.20.0-0.rhaos4.7.git8921e00.el7.51
  • cri-o openshift 4.7 1.20.0-0.rhaos4.7.git8921e00.el8.51
  • ignition openshift 4.7 2.9.0-2.rhaos4.7.git1d56dc8.el8
  • cri-tools openshift 4.7 1.18.0-3.el7
  • cri-tools openshift 4.7 1.20.0-1.el8
  • openshift openshift 4.7 4.7.0-202102060108.p0.git.97095.7271b90.el7
  • openshift openshift 4.7 4.7.0-202102060108.p0.git.97095.7271b90.el8
  • python-rsa openshift 4.7 4.7-1.el8

red hat advisories RHSA-2020:5634

  • libcontainers-common SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES 15 SP2-LTSS +12 more 20210626-150100.3.15.1
  • podman SLE Module for Containers 15 SP3, SLE Micro 5.1 3.4.4-150300.9.3.2
  • conmon SLE Module for Containers 15 SP3, SLE Micro 5.1 2.0.30-150300.8.3.1
  • libseccomp SLE Module for Basesystem 15 SP3, SLE Micro 5.1 2.5.3-150300.10.5.1
  • libcontainers-common SLE Module for Basesystem 15 SP3, SLE Micro 5.1 20210626-150300.8.3.1
  • golang-github-docker-libnetwork SLE Module for Containers 12 0.7.0.1+gitr2908_55e924b8a842-37.1
  • docker SLE Module for Containers 12 19.03.15_ce-98.60.2
  • containerd SLE Module for Containers 12 1.3.9-16.35.1

suse advisories SUSE-SU-2022:3312-1SUSE-SU-2022:23018-1SUSE-SU-2021:0445-1

  • containerd openSUSE Tumbleweed 1.4.8-2.2
  • libcontainers-common openSUSE Tumbleweed 20210626-7.1
  • podman openSUSE Leap 15.3 3.4.4-150300.9.3.2
  • conmon openSUSE Leap 15.3 2.0.30-150300.8.3.1
  • libseccomp openSUSE Leap 15.3 2.5.3-150300.10.5.1
  • libcontainers-common openSUSE Leap 15.3 20210626-150300.8.3.1

opensuse advisories openSUSE-SU-2024:10693-1openSUSE-SU-2024:11757-1openSUSE-SU-2022:23018-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-15157 updated cvss 6.1

containerd: credentials leak during image pull

  • Red Hat OpenShift Container Platform 4 openshift4/ose-cluster-autoscaler
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4.7 openshift 4.7.0-202102060108.p0.git.97095.7271b90.el7, openshift 4.7.0-202102060108.p0.git.97095.7271b90.el8, openshift-hyperkube 4.7.0-202102060108.p0.git.97095.7271b90.el7, openshift-hyperkube 4.7.0-202102060108.p0.git.97095.7271b90.el8
    fixed: vendor fix RHSA-2020:5634
  • Red Hat OpenShift Service Mesh 1 servicemesh, servicemesh-mixc, servicemesh-mixs, servicemesh-galley, servicemesh-citadel, servicemesh-istioctl, +3 more Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-rhel7-operator Red Hat Advanced Cluster Management for Kubernetes 2 containerd Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more Red Hat OpenShift Container Platform 4 openshift4/ose-cli, openshift4/ose-console, openshift4/ose-hyperkube, openshift4/ose-ptp-operator, openshift4/ose-helm-operator, redhat/redhat-operator-index, +4 more Red Hat OpenShift Container Platform 4.7 jq 1.6-2.el7, jq 1.6-2.el8, clevis 15-1.el8, faq 0.0.6-5.el8, bootupd 0.2.5-2.el8, ostree 2020.7-1.el8, +264 more
    +1 more products
    Red Hat OpenShift Virtualization 2 vm-import-controller, kubernetes-nmstate-handler, cluster-network-addons-operator
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.30% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
NVD 2.0 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/containerd/containerd
<1.2.14
1.2.14

Affected products

  • containerd containerd

Classification

Weakness
  • CWE-522 Insufficiently Protected Credentials

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.