SB20250521127 - Fedora 43 update for containerd

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20250521127

SB20250521127 - Fedora 43 update for containerd

Published: May 21, 2025

Security Bulletin ID SB20250521127
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2025-47290)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a race condition while unpacking an image during an image pull. A remote attacker can trick the victim into using a specially crafted image and perform arbitrary modifications of the host file system, leading to its compromise.


2) Input validation error (CVE-ID: CVE-2025-22872)

The vulnerability allows a remote attacker to perform code injection attacks.

The vulnerability exists due to insufficient validation of tags with unquoted attribute values that end with a solidus character (/). The tokenizer can interpret such tags as self-closing, leading to content following such tags as being placed in the wrong scope during DOM construction.


Remediation

Install update from vendor's website.

References