Information Exposure Affecting Open this link in a new tab package, versions <1.2.14

  • Exploit Maturity

    Proof of concept

  • Attack Complexity


  • User Interaction


  • Scope


  • Confidentiality


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    18 Oct 2020

  • disclosed

    18 Oct 2020

  • credit

    Brad Geesaman, Josh Larsen, Ian Coldwater, Duffie Cooley, Rory McCune

How to fix?

Upgrade to version 1.2.14 or higher.

Overview is a docker container runtime with an emphasis on simplicity, robustness and portability.

Affected versions of this package are vulnerable to Information Exposure. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a “foreign layer”), the default containerd resolver will follow that URL to attempt to download it.