Vulnerability Name:

CVE-2021-41190 (CCN-213802)

Assigned:2021-11-17
Published:2021-11-17
Updated:2021-12-10
Summary:The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.
CVSS v3 Severity:5.0 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N)
4.4 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
3.0 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N)
2.6 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
5.0 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N)
4.4 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
2.1 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-843
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2021-41190

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20211119 CVE-2021-41190 OCI distribution and image spec: "content-type" confusion

Source: XF
Type: UNKNOWN
opencontainers-cve202141190-sec-bypass(213802)

Source: CCN
Type: containerd GIT Repository
Merge pull request from GHSA-5j5w-g665-5m35

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/opencontainers/distribution-spec/commit/ac28cac0557bcd3084714ab09f9f2356fe504923

Source: CCN
Type: distribution-spec GIT Repository
Clarify Content-Type handling

Source: CONFIRM
Type: Third Party Advisory
https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-3dda301691

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-62352983b4

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-d250fc2622

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-6dc68dbe4d

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-aacef7fa15

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-79ba5abef6

Source: FEDORA
Type: Third Party Advisory
FEDORA-2021-eb2742b148

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-6789ed60f2

Source: CCN
Type: oss-sec Mailing List, Fri, 19 Nov 2021 10:18:20 -0500
CVE-2021-41190 OCI distribution and image spec: "content-type" confusion

Source: CCN
Type: IBM Security Bulletin 6599703 (Db2 On Openshift)
Multiple vulnerabilities affect IBM Db2 On Openshift and IBM Db2 and Db2 Warehouse on Cloud Pak for Data

Source: CCN
Type: IBM Security Bulletin 6615221 (Robotic Process Automation for Cloud Pak)
Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

Source: CCN
Type: IBM Security Bulletin 6833298 (CICS TX Standard)
IBM CICS TX Standard is vulnerable to an Open Container Initiative Distribution Specification vulnerability (CVE-2021-41190).

Source: CCN
Type: IBM Security Bulletin 6833300 (CICS TX Advanced)
IBM CICS TX Advanced is vulnerable to an Open Container Initiative Distribution Specification vulnerability (CVE-2021-41190).

Source: CCN
Type: IBM Security Bulletin 6999559 (Edge Application Manager)
IBM Edge Application Manager 4.5 addresses multiple security vulnerabilities

Source: CCN
Type: IBM Security Bulletin 7002503 (Cloud Pak for Security)
IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Source: CCN
Type: WhiteSource Vulnerability Database
WS-2021-0427

Vulnerable Configuration:Configuration 1:
  • cpe:/a:linuxfoundation:open_container_initiative_distribution_specification:*:*:*:*:*:*:*:* (Version <= 1.0.0)
  • OR cpe:/a:linuxfoundation:open_container_initiative_image_format_specification:*:*:*:*:*:*:*:* (Version <= 1.0.1)

    • Configuration 2:
  • cpe:/o:fedoraproject:fedora:34:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:35:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:linuxfoundation:containerd:1.5.0:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2_warehouse:3.5:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2_warehouse:4.0:-:*:*:*:*:*:*
  • OR cpe:/a:linuxfoundation:containerd:1.4.11:*:*:*:*:*:*:*
  • OR cpe:/a:linuxfoundation:containerd:1.5.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:3.5:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:4.0:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:cics_tx:11.1:*:*:*:standard:*:*:*
  • OR cpe:/a:ibm:cics_tx:11.1:*:*:*:advanced:*:*:*
  • OR cpe:/a:ibm:robotic_process_automation_for_cloud_pak:21.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:robotic_process_automation_for_cloud_pak:21.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:robotic_process_automation_for_cloud_pak:21.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.10.0.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7853
    P
    		docker-20.10.23_ce-150000.175.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:7862
    P
    		podman-4.4.4-150500.1.4 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:7850
    P
    		containerd-1.6.19-150000.87.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:51990
    P
    		Security update for podman (Important)
    2023-01-27
    oval:com.redhat.rhsa:def:20227457
    P
    		RHSA-2022:7457: container-tools:rhel8 security, bug fix, and enhancement update (Moderate)
    2022-11-08
    oval:org.opensuse.security:def:3247
    P
    		libraptor2-0-2.0.10-3.63 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3242
    P
    		libpython3_4m1_0-3.4.6-25.29.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3243
    P
    		libpython3_6m1_0-3.6.8-2.13 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94872
    P
    		containerd-1.4.12-150000.65.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94873
    P
    		docker-20.10.12_ce-159.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94877
    P
    		podman-3.4.4-150400.2.14 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:98958
    P
    		Security update for conmon, libcontainers-common, libseccomp, podman (Moderate)
    2022-03-04
    oval:org.opensuse.security:def:101684
    P
    		Security update for conmon, libcontainers-common, libseccomp, podman (Moderate)
    2022-02-25
    oval:org.opensuse.security:def:42308
    P
    		Security update for conmon, libcontainers-common, libseccomp, podman (Moderate)
    2022-02-25
    oval:org.opensuse.security:def:923
    P
    		Security update for conmon, libcontainers-common, libseccomp, podman (Moderate)
    2022-02-25
    oval:org.opensuse.security:def:101615
    P
    		Security update for conmon, libcontainers-common, libseccomp, podman (Moderate)
    2022-02-25
    oval:org.opensuse.security:def:994
    P
    		Security update for conmon, libcontainers-common, libseccomp, podman (Moderate)
    2022-02-25
    oval:org.opensuse.security:def:99209
    P
    		 (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:94474
    P
    		 (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:93163
    P
    		 (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:996
    P
    		Security update for containerd, docker (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:100413
    P
    		 (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:93841
    P
    		 (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:42192
    P
    		Security update for containerd, docker (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:101687
    P
    		Security update for containerd, docker (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:99483
    P
    		 (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:93321
    P
    		 (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:100747
    P
    		 (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:94053
    P
    		 (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:99745
    P
    		 (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:93481
    P
    		 (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:94267
    P
    		 (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:42336
    P
    		Security update for containerd, docker (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:100075
    P
    		 (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:93632
    P
    		 (Moderate)
    2022-02-04
    oval:org.opensuse.security:def:113440
    P
    		singularity-3.8.5-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:112095
    P
    		containerd-1.4.12-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:112163
    P
    		docker-20.10.11_ce-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:113151
    P
    		podman-3.4.4-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:111519
    P
    		Security update for singularity (Moderate)
    2021-12-04
    oval:org.opensuse.security:def:11151
    P
    		Security update for singularity (Moderate)
    2021-12-04
    BACK
    linuxfoundation open container initiative distribution specification *
    linuxfoundation open container initiative image format specification *
    fedoraproject fedora 34
    fedoraproject fedora 35
    linuxfoundation containerd 1.5.0 -
    ibm db2 warehouse 3.5 -
    ibm db2 warehouse 4.0 -
    linuxfoundation containerd 1.4.11
    linuxfoundation containerd 1.5.7
    ibm db2 3.5 -
    ibm db2 4.0 -
    ibm cics tx 11.1
    ibm cics tx 11.1
    ibm robotic process automation for cloud pak 21.0.1
    ibm robotic process automation for cloud pak 21.0.2
    ibm robotic process automation for cloud pak 21.0.3
    ibm cloud pak for security 1.10.0.0