{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.11",
        "name": "containerd",
        "purl": "pkg:apk/alpine/containerd?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.3.9-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.12",
        "name": "containerd",
        "purl": "pkg:apk/alpine/containerd?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.3-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.13",
        "name": "containerd",
        "purl": "pkg:apk/alpine/containerd?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.3-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.14",
        "name": "containerd",
        "purl": "pkg:apk/alpine/containerd?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.3-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.15",
        "name": "containerd",
        "purl": "pkg:apk/alpine/containerd?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.3-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.16",
        "name": "containerd",
        "purl": "pkg:apk/alpine/containerd?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.3-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.17",
        "name": "containerd",
        "purl": "pkg:apk/alpine/containerd?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.3-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.18",
        "name": "containerd",
        "purl": "pkg:apk/alpine/containerd?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.3-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.19",
        "name": "containerd",
        "purl": "pkg:apk/alpine/containerd?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.3-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.20",
        "name": "containerd",
        "purl": "pkg:apk/alpine/containerd?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.3-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.21",
        "name": "containerd",
        "purl": "pkg:apk/alpine/containerd?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.3-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.22",
        "name": "containerd",
        "purl": "pkg:apk/alpine/containerd?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.3-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.23",
        "name": "containerd",
        "purl": "pkg:apk/alpine/containerd?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.3-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.24",
        "name": "containerd",
        "purl": "pkg:apk/alpine/containerd?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.3-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.12",
        "name": "docker",
        "purl": "pkg:apk/alpine/docker?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.03.14-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.13",
        "name": "docker",
        "purl": "pkg:apk/alpine/docker?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.03.14-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.14",
        "name": "docker",
        "purl": "pkg:apk/alpine/docker?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.03.14-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.15",
        "name": "docker",
        "purl": "pkg:apk/alpine/docker?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.03.14-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.16",
        "name": "docker",
        "purl": "pkg:apk/alpine/docker?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.03.14-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.17",
        "name": "docker",
        "purl": "pkg:apk/alpine/docker?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.03.14-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.18",
        "name": "docker",
        "purl": "pkg:apk/alpine/docker?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.03.14-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.19",
        "name": "docker",
        "purl": "pkg:apk/alpine/docker?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.03.14-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.20",
        "name": "docker",
        "purl": "pkg:apk/alpine/docker?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.03.14-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.21",
        "name": "docker",
        "purl": "pkg:apk/alpine/docker?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.03.14-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.22",
        "name": "docker",
        "purl": "pkg:apk/alpine/docker?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.03.14-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.23",
        "name": "docker",
        "purl": "pkg:apk/alpine/docker?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.03.14-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.24",
        "name": "docker",
        "purl": "pkg:apk/alpine/docker?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.03.14-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.13",
        "name": "k3s",
        "purl": "pkg:apk/alpine/k3s?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.19.4.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.14",
        "name": "k3s",
        "purl": "pkg:apk/alpine/k3s?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.19.4.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.15",
        "name": "k3s",
        "purl": "pkg:apk/alpine/k3s?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.19.4.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.16",
        "name": "k3s",
        "purl": "pkg:apk/alpine/k3s?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.19.4.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.17",
        "name": "k3s",
        "purl": "pkg:apk/alpine/k3s?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.19.4.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.18",
        "name": "k3s",
        "purl": "pkg:apk/alpine/k3s?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.19.4.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.19",
        "name": "k3s",
        "purl": "pkg:apk/alpine/k3s?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.19.4.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.20",
        "name": "k3s",
        "purl": "pkg:apk/alpine/k3s?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.19.4.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.21",
        "name": "k3s",
        "purl": "pkg:apk/alpine/k3s?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.19.4.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.22",
        "name": "k3s",
        "purl": "pkg:apk/alpine/k3s?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.19.4.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.23",
        "name": "k3s",
        "purl": "pkg:apk/alpine/k3s?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.19.4.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.24",
        "name": "k3s",
        "purl": "pkg:apk/alpine/k3s?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.19.4.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the \"host\" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container.",
  "id": "ALPINE-CVE-2020-15257",
  "modified": "2026-11-03T06:17:57.221369563Z",
  "published": "2020-12-01T03:15:11.257Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security.alpinelinux.org/vuln/CVE-2020-15257"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2020-15257"
  ]
}