CVE-2021-41190 - CVE House

Back to Database

Status published Low CVE-2021-41190

Clarify Content-Type handling in OCI spec

3 CVSS

Vulnerability Description

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41190

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from opencontainers

View All →

runc: LSM labels can be bypassed with malicious config using dummy procfs files

container escape due to /dev/console mount and related races

runc container escape via "masked path" abuse due to mount race conditions

runc can be confused to create empty files/directories on the host

runc container breakout through process.cwd trickery and leaked fds

Affected Vendor

opencontainers

View all reports →

Affected Software

distribution-spec

Vulnerable Versions:

< 1.0.1

Timeline

Official Publish: November 17th, 2021

Last Modified: August 4th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1055 Process Injection

Defense Evasion

T1105 Ingress Tool Transfer

Command and Control

T1499 Endpoint Denial of Service