Lucene search

[email protected]NVD:CVE-2020-1702

HistoryMay 27, 2021 - 8:15 p.m.

CVE-2020-1702

2021-05-2720:15:07

CWE-400

[email protected]

web.nvd.nist.gov

flaw

memory consumption

red hat enterprise linux

openshift container platform

image pulling

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

EPSS

0.001

Percentile

22.8%

JSON

A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker can use this flaw to trick a user, with privileges to pull container images, into crashing the process responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.

Affected configurations

Nvd

Node

containers-image_projectcontainers-imageRange<5.2.0

Node

redhatenterprise_linuxMatch8.0

VendorProductVersionCPE
containers-image_projectcontainers-image*cpe:2.3:a:containers-image_project:containers-image:*:*:*:*:*:*:*:*
redhatenterprise_linux8.0cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
containers-image_project	containers-image	*	cpe:2.3:a:containers-image_project:containers-image::::::::
redhat	enterprise_linux	8.0	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*