CVE catalog

CVE-2020-15157

containerd: CVE-2020-15157

Severity: Medium · CVSS 6.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Published: Oct 15, 2020, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.30% · Oct 25, 2026

In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a “foreign layer”), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources. Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	docker.io	sid	`28.5.2+dfsg4-5`	fixed
Debian	docker.io	forky	`28.5.2+dfsg4-5`	fixed
Debian	docker.io	trixie	`26.1.5+dfsg1-9+deb13u1`	fixed
Debian	docker.io	trixie-security	`26.1.5+dfsg1-9+deb13u1`	fixed
Debian	docker.io	bookworm	`20.10.24+dfsg1-1+deb12u1`	fixed
Debian	containerd	sid	`2.1.9+ds1-5`	fixed
Debian	containerd	forky	`2.1.9+ds1-5`	fixed
Debian	containerd	trixie	`1.7.24~ds1-6+deb13u1`	fixed
Debian	containerd	trixie-security	`1.7.24~ds1-6+deb13u1`	fixed
Debian	containerd	bookworm	`1.6.20~ds1-1+deb12u3`	fixed
Debian	containerd	bookworm-security	`1.6.20~ds1-1+deb12u2`	fixed
Ubuntu	containerd	16.04	`0.2.1-0ubuntu4~16.04`	vulnerable
Ubuntu	containerd	16.04	`0.2.3-0ubuntu1~16.04`	vulnerable
Ubuntu	containerd	16.04	`0.2.5-0ubuntu1~16.04.1`	vulnerable
Ubuntu	containerd	16.04	`1.2.6-0ubuntu1~16.04.2`	vulnerable
Ubuntu	containerd	16.04	`1.2.6-0ubuntu1~16.04.3`	vulnerable
Ubuntu	containerd	16.04	`1.2.6-0ubuntu1~16.04.4`	fixed
Ubuntu	docker.io	16.04	`1.6.2~dfsg1-1ubuntu4`	vulnerable
Ubuntu	docker.io	16.04	`1.10.2-0ubuntu3`	vulnerable
Ubuntu	docker.io	16.04	`1.10.2-0ubuntu4`	vulnerable
Ubuntu	docker.io	16.04	`1.10.3-0ubuntu1`	vulnerable
Ubuntu	docker.io	16.04	`1.10.3-0ubuntu4`	vulnerable
Ubuntu	docker.io	16.04	`1.10.3-0ubuntu5`	vulnerable
Ubuntu	docker.io	16.04	`1.10.3-0ubuntu6`	vulnerable
Ubuntu	docker.io	16.04	`1.11.2-0ubuntu5~16.04`	vulnerable
Ubuntu	docker.io	16.04	`1.12.1-0ubuntu13~16.04.1`	vulnerable
Ubuntu	docker.io	16.04	`1.12.3-0ubuntu4~16.04.2`	vulnerable
Ubuntu	docker.io	16.04	`1.12.6-0ubuntu1~16.04.1`	vulnerable
Ubuntu	docker.io	16.04	`1.13.1-0ubuntu1~16.04.2`	vulnerable
Ubuntu	docker.io	16.04	`17.03.2-0ubuntu2~16.04.1`	vulnerable
Ubuntu	docker.io	16.04	`18.06.1-0ubuntu1~16.04.2`	vulnerable
Ubuntu	docker.io	16.04	`18.06.1-0ubuntu1.2~16.04.1`	vulnerable
Ubuntu	docker.io	16.04	`18.09.2-0ubuntu1~16.04.1`	vulnerable
Ubuntu	docker.io	16.04	`18.09.5-0ubuntu1~16.04.2`	vulnerable
Ubuntu	docker.io	16.04	`18.09.7-0ubuntu1~16.04.1`	vulnerable
Ubuntu	docker.io	16.04	`18.09.7-0ubuntu1~16.04.4`	vulnerable
Ubuntu	docker.io	16.04	`18.09.7-0ubuntu1~16.04.5`	vulnerable
Ubuntu	docker.io	16.04	`18.09.7-0ubuntu1~16.04.6`	fixed
Ubuntu	docker.io	18.04	`1.13.1-0ubuntu6`	vulnerable
Ubuntu	docker.io	18.04	`17.03.2-0ubuntu1`	vulnerable
Ubuntu	docker.io	18.04	`17.03.2-0ubuntu3`	vulnerable
Ubuntu	docker.io	18.04	`17.03.2-0ubuntu5`	vulnerable
Ubuntu	docker.io	18.04	`17.12.1-0ubuntu1`	vulnerable
Ubuntu	docker.io	18.04	`18.06.1-0ubuntu1~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`18.06.1-0ubuntu1.2~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`18.09.2-0ubuntu1~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`18.09.5-0ubuntu1~18.04.2`	vulnerable
Ubuntu	docker.io	18.04	`18.09.7-0ubuntu1~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`18.09.7-0ubuntu1~18.04.3`	vulnerable
Ubuntu	docker.io	18.04	`18.09.7-0ubuntu1~18.04.4`	vulnerable
Ubuntu	docker.io	18.04	`19.03.6-0ubuntu1~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`19.03.6-0ubuntu1~18.04.2`	fixed
Ubuntu	docker.io	20.04	`19.03.2-0ubuntu1`	vulnerable
Ubuntu	docker.io	20.04	`19.03.6-0ubuntu1`	vulnerable
Ubuntu	docker.io	20.04	`19.03.8-0ubuntu1`	vulnerable
Ubuntu	docker.io	20.04	`19.03.8-0ubuntu1.20.04`	vulnerable
Ubuntu	docker.io	20.04	`19.03.8-0ubuntu1.20.04.1`	fixed
Ubuntu	containerd	16.04	`0.2.1-0ubuntu4~16.04`	vulnerable
Ubuntu	containerd	16.04	`0.2.3-0ubuntu1~16.04`	vulnerable
Ubuntu	containerd	16.04	`0.2.5-0ubuntu1~16.04.1`	vulnerable
Ubuntu	containerd	16.04	`1.2.6-0ubuntu1~16.04.2`	vulnerable
Ubuntu	containerd	16.04	`1.2.6-0ubuntu1~16.04.3`	vulnerable
Ubuntu	containerd	16.04	`1.2.6-0ubuntu1~16.04.4`	fixed
Ubuntu	docker.io	16.04	`1.6.2~dfsg1-1ubuntu4`	vulnerable
Ubuntu	docker.io	16.04	`1.10.2-0ubuntu3`	vulnerable
Ubuntu	docker.io	16.04	`1.10.2-0ubuntu4`	vulnerable
Ubuntu	docker.io	16.04	`1.10.3-0ubuntu1`	vulnerable
Ubuntu	docker.io	16.04	`1.10.3-0ubuntu4`	vulnerable
Ubuntu	docker.io	16.04	`1.10.3-0ubuntu5`	vulnerable
Ubuntu	docker.io	16.04	`1.10.3-0ubuntu6`	vulnerable
Ubuntu	docker.io	16.04	`1.11.2-0ubuntu5~16.04`	vulnerable
Ubuntu	docker.io	16.04	`1.12.1-0ubuntu13~16.04.1`	vulnerable
Ubuntu	docker.io	16.04	`1.12.3-0ubuntu4~16.04.2`	vulnerable
Ubuntu	docker.io	16.04	`1.12.6-0ubuntu1~16.04.1`	vulnerable
Ubuntu	docker.io	16.04	`1.13.1-0ubuntu1~16.04.2`	vulnerable
Ubuntu	docker.io	16.04	`17.03.2-0ubuntu2~16.04.1`	vulnerable
Ubuntu	docker.io	16.04	`18.06.1-0ubuntu1~16.04.2`	vulnerable
Ubuntu	docker.io	16.04	`18.06.1-0ubuntu1.2~16.04.1`	vulnerable
Ubuntu	docker.io	16.04	`18.09.2-0ubuntu1~16.04.1`	vulnerable
Ubuntu	docker.io	16.04	`18.09.5-0ubuntu1~16.04.2`	vulnerable
Ubuntu	docker.io	16.04	`18.09.7-0ubuntu1~16.04.1`	vulnerable
Ubuntu	docker.io	16.04	`18.09.7-0ubuntu1~16.04.4`	vulnerable
Ubuntu	docker.io	16.04	`18.09.7-0ubuntu1~16.04.5`	vulnerable
Ubuntu	docker.io	16.04	`18.09.7-0ubuntu1~16.04.6`	fixed
Ubuntu	docker.io	18.04	`1.13.1-0ubuntu6`	vulnerable
Ubuntu	docker.io	18.04	`17.03.2-0ubuntu1`	vulnerable
Ubuntu	docker.io	18.04	`17.03.2-0ubuntu3`	vulnerable
Ubuntu	docker.io	18.04	`17.03.2-0ubuntu5`	vulnerable
Ubuntu	docker.io	18.04	`17.12.1-0ubuntu1`	vulnerable
Ubuntu	docker.io	18.04	`18.06.1-0ubuntu1~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`18.06.1-0ubuntu1.2~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`18.09.2-0ubuntu1~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`18.09.5-0ubuntu1~18.04.2`	vulnerable
Ubuntu	docker.io	18.04	`18.09.7-0ubuntu1~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`18.09.7-0ubuntu1~18.04.3`	vulnerable
Ubuntu	docker.io	18.04	`18.09.7-0ubuntu1~18.04.4`	vulnerable
Ubuntu	docker.io	18.04	`19.03.6-0ubuntu1~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`19.03.6-0ubuntu1~18.04.2`	fixed
Ubuntu	docker.io	20.04	`19.03.2-0ubuntu1`	vulnerable
Ubuntu	docker.io	20.04	`19.03.6-0ubuntu1`	vulnerable
Ubuntu	docker.io	20.04	`19.03.8-0ubuntu1`	vulnerable
Ubuntu	docker.io	20.04	`19.03.8-0ubuntu1.20.04`	vulnerable
Ubuntu	docker.io	20.04	`19.03.8-0ubuntu1.20.04.1`	fixed
Suse	containerd	linux enterprise module for containers 12	`1.3.9-16.35.1`	fixed
Suse	docker	linux enterprise module for containers 12	`19.03.15_ce-98.60.2`	fixed
Suse	docker-runc	linux enterprise module for containers 12	`1.0.0rc10+gitr3981_dc9208a3303f-1.52.1`	fixed
Suse	golang-github-docker-libnetwork	linux enterprise module for containers 12	`0.7.0.1+gitr2908_55e924b8a842-37.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	docker.io	source	sid	`19.03.13+dfsg2-1`	not yet assigned	Not reported	Not reported
Debian	docker.io	source	forky	`19.03.13+dfsg2-1`	not yet assigned	Not reported	Not reported
Debian	docker.io	source	trixie	`19.03.13+dfsg2-1`	not yet assigned	Not reported	Not reported
Debian	docker.io	source	bookworm	`19.03.13+dfsg2-1`	not yet assigned	Not reported	Not reported
Debian	containerd	source	sid	`1.3.2~ds1-2`	not yet assigned	Not reported	Not reported
Debian	containerd	source	forky	`1.3.2~ds1-2`	not yet assigned	Not reported	Not reported
Debian	containerd	source	trixie	`1.3.2~ds1-2`	not yet assigned	Not reported	Not reported
Debian	containerd	source	bookworm	`1.3.2~ds1-2`	not yet assigned	Not reported	Not reported
Ubuntu	containerd	deb	16.04	`1.2.6-0ubuntu1~16.04.4`	Not reported	USN-4589-1	Not reported
Ubuntu	docker.io	deb	16.04	`18.09.7-0ubuntu1~16.04.6`	Not reported	USN-4589-2	Not reported
Ubuntu	docker.io	deb	18.04	`19.03.6-0ubuntu1~18.04.2`	Not reported	USN-4589-2	Not reported
Ubuntu	docker.io	deb	20.04	`19.03.8-0ubuntu1.20.04.1`	Not reported	USN-4589-2	Not reported
Ubuntu	containerd	deb	16.04	`1.2.6-0ubuntu1~16.04.4`	Not reported	UBUNTU-CVE-2020-15157	Not reported
Ubuntu	docker.io	deb	16.04	`18.09.7-0ubuntu1~16.04.6`	Not reported	UBUNTU-CVE-2020-15157	Not reported
Ubuntu	docker.io	deb	18.04	`19.03.6-0ubuntu1~18.04.2`	Not reported	UBUNTU-CVE-2020-15157	Not reported
Ubuntu	docker.io	deb	20.04	`19.03.8-0ubuntu1.20.04.1`	Not reported	UBUNTU-CVE-2020-15157	Not reported
Suse	containerd	rpm	linux enterprise module for containers 12	`1.3.9-16.35.1`	Not reported	SUSE-SU-2021:0445-1	Not reported
Suse	docker	rpm	linux enterprise module for containers 12	`19.03.15_ce-98.60.2`	Not reported	SUSE-SU-2021:0445-1	Not reported
Suse	docker-runc	rpm	linux enterprise module for containers 12	`1.0.0rc10+gitr3981_dc9208a3303f-1.52.1`	Not reported	SUSE-SU-2021:0445-1	Not reported
Suse	golang-github-docker-libnetwork	rpm	linux enterprise module for containers 12	`0.7.0.1+gitr2908_55e924b8a842-37.1`	Not reported	SUSE-SU-2021:0445-1	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[containerd]Unknown
Details (4)
- 1.6.20~ds1-1+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
- 1.6.20~ds1-1+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
- 1.6.20~ds1-1+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
- 1.6.20~ds1-1+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
[docker-doc]Unknown
Source package: [docker.io]
Details (2)
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12
[docker.io]Unknown
Source package: [docker.io]
Details (2)
- 20.10.24+dfsg1-1+deb12u1+b6 · amd64 · bookworm
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12
- 20.10.24+dfsg1-1+deb12u1+b6 · arm64 · bookworm
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12
[golang-github-containerd-containerd-dev]Unknown
Source package: [containerd]
Details (4)
- 1.6.20~ds1-1+deb12u3 · all · bookworm
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
- 1.6.20~ds1-1+deb12u3 · all · bookworm
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
- 1.6.20~ds1-1+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
- 1.6.20~ds1-1+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · bookworm; dsa · containerd · debian · 12
[golang-github-docker-docker-dev]Unknown
Source package: [docker.io]
Details (2)
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

[Debian 13 (Trixie)]

[containerd]Unknown
Details (4)
- 1.7.24~ds1-6+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · 13
- 1.7.24~ds1-6+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · 13
- 1.7.24~ds1-6+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · 13
- 1.7.24~ds1-6+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · 13
[docker-cli]Unknown
Source package: [docker.io]
Details (4)
- 26.1.5+dfsg1-9+b13 · amd64 · trixie
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+b13 · arm64 · trixie
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13
[docker-doc]Unknown
Source package: [docker.io]
Details (4)
- 26.1.5+dfsg1-9 · all · trixie
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9 · all · trixie
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · all · trixie-security
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · all · trixie-security
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13
[docker.io]Unknown
Details (4)
- 26.1.5+dfsg1-9+b13 · amd64 · trixie
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+b13 · arm64 · trixie
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13
[golang-github-containerd-containerd-dev]Unknown
Source package: [containerd]
Details (4)
- 1.7.24~ds1-6+deb13u1 · all · trixie
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · 13
- 1.7.24~ds1-6+deb13u1 · all · trixie
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · 13
- 1.7.24~ds1-6+deb13u1 · all · trixie-security
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · 13
- 1.7.24~ds1-6+deb13u1 · all · trixie-security
  Fixed · Fixed: 1.3.2~ds1-2
  dsa · containerd · debian · 13
[golang-github-docker-docker-dev]Unknown
Source package: [docker.io]
Details (4)
- 26.1.5+dfsg1-9 · all · trixie
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9 · all · trixie
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · all · trixie-security
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · all · trixie-security
  Fixed · Fixed: 19.03.13+dfsg2-1
  dsa · docker.io · debian · 13

Observed: Oct 23, 2026, 5:48:13 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]