The version of containerd installed on the remote host is prior to 1.4.6-7.11. The version of docker installed on the remote host is prior to 20.10.7-5.76. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1551 advisory.

    In the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version     1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP     header. Versions of Moby (Docker Engine) prior to 20.10.11 and versions of containerd prior to 1.4.12 and     1.5.8 treat the Content-Type header as trusted and deserialize the document according to that header. If     the Content-Type header changed between pulls of the same ambiguous document (with the same digest), the     document may be interpreted differently, meaning that the digest alone is insufficient to unambiguously     identify the content of the image. (CVE-2021-41190)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux AMI : containerd, docker (ALAS-2021-1551)

medium Nessus Plugin ID 155607

Version 1.4