CVE catalog

CVE-2021-41190

docker-20.10.11_ce-1.1 on GA media

[CVE catalog]

Severity
Medium · CVSS 5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
2.22% · Oct 25, 2026

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntudocker.iopro1.6.2~dfsg1-1ubuntu4vulnerable
Ubuntudocker.iopro1.10.2-0ubuntu3vulnerable
Ubuntudocker.iopro1.10.2-0ubuntu4vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu1vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu4vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu5vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu6vulnerable
Ubuntudocker.iopro1.11.2-0ubuntu5~16.04vulnerable
Ubuntudocker.iopro1.12.1-0ubuntu13~16.04.1vulnerable
Ubuntudocker.iopro1.12.3-0ubuntu4~16.04.2vulnerable
Ubuntudocker.iopro1.12.6-0ubuntu1~16.04.1vulnerable
Ubuntudocker.iopro1.13.1-0ubuntu1~16.04.2vulnerable
Ubuntudocker.iopro17.03.2-0ubuntu2~16.04.1vulnerable
Ubuntudocker.iopro18.06.1-0ubuntu1~16.04.2vulnerable
Ubuntudocker.iopro18.06.1-0ubuntu1.2~16.04.1vulnerable
Ubuntudocker.iopro18.09.2-0ubuntu1~16.04.1vulnerable
Ubuntudocker.iopro18.09.5-0ubuntu1~16.04.2vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.1vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.4vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.5vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.6vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.7vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.9+esm1vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.9+esm2vulnerable
Ubuntucontainerdpro0.2.1-0ubuntu4~16.04vulnerable
Ubuntucontainerdpro0.2.3-0ubuntu1~16.04vulnerable
Ubuntucontainerdpro0.2.5-0ubuntu1~16.04.1vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.2vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.3vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.4vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.5vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm1vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm2vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm4vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm5vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm6vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm7vulnerable
Ubuntucontainerd18.040.2.5-0ubuntu2vulnerable
Ubuntucontainerd18.041.2.6-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.2.6-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.3vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.4vulnerable
Ubuntucontainerd18.041.4.4-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.3vulnerable
Ubuntucontainerd18.041.5.5-0ubuntu3~18.04.1vulnerable
Ubuntucontainerd18.041.5.5-0ubuntu3~18.04.2vulnerable
Ubuntucontainerd18.041.5.9-0ubuntu1~18.04.1fixed
Ubuntudocker.iopro1.13.1-0ubuntu6vulnerable
Ubuntudocker.iopro17.03.2-0ubuntu1vulnerable
Ubuntudocker.iopro17.03.2-0ubuntu3vulnerable
Ubuntudocker.iopro17.03.2-0ubuntu5vulnerable
Ubuntudocker.iopro17.12.1-0ubuntu1vulnerable
Ubuntudocker.iopro18.06.1-0ubuntu1~18.04.1vulnerable
Ubuntudocker.iopro18.06.1-0ubuntu1.2~18.04.1vulnerable
Ubuntudocker.iopro18.09.2-0ubuntu1~18.04.1vulnerable
Ubuntudocker.iopro18.09.5-0ubuntu1~18.04.2vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~18.04.1vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~18.04.3vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~18.04.4vulnerable
Ubuntudocker.iopro19.03.6-0ubuntu1~18.04.1vulnerable
Ubuntudocker.iopro19.03.6-0ubuntu1~18.04.2vulnerable
Ubuntudocker.iopro19.03.6-0ubuntu1~18.04.3vulnerable
Ubuntudocker.iopro20.10.2-0ubuntu1~18.04.2vulnerable
Ubuntudocker.iopro20.10.2-0ubuntu1~18.04.3vulnerable
Ubuntudocker.iopro20.10.7-0ubuntu1~18.04.1vulnerable
Ubuntudocker.iopro20.10.7-0ubuntu1~18.04.2vulnerable
Ubuntudocker.iopro20.10.7-0ubuntu5~18.04.2vulnerable
Ubuntudocker.iopro20.10.7-0ubuntu5~18.04.3vulnerable
Ubuntudocker.iopro20.10.12-0ubuntu2~18.04.1vulnerable
Ubuntudocker.iopro20.10.21-0ubuntu1~18.04.2vulnerable
Ubuntudocker.iopro20.10.21-0ubuntu1~18.04.3vulnerable
Ubuntudocker.iopro20.10.21-0ubuntu1~18.04.3+esm1vulnerable
Ubuntudocker.iopro20.10.21-0ubuntu1~18.04.3+esm2vulnerable
Ubuntudocker.iopro20.10.21-0ubuntu1~18.04.3+esm3vulnerable
Ubuntucontainerd20.041.2.10-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.2-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.3vulnerable
Ubuntucontainerd20.041.4.4-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.3vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.1vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.2vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.4fixed
Ubuntucontainerd22.041.5.5-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu1fixed
Opensuseumocitumbleweed0.5.0-1.1fixed
Opensusesingularitytumbleweed3.8.5-1.1fixed
Susesingularitypackage hub 15 sp33.8.5-bp153.2.10.1fixed
Opensusesingularityleap 15.33.8.5-bp153.2.10.1fixed
Opensusecontainerdtumbleweed1.4.12-1.1fixed
Susecontainerdlinux enterprise module for containers 121.5.11-16.57.1fixed
Susedockerlinux enterprise module for containers 1220.10.14_ce-98.80.1fixed
Suseumocilinux enterprise module for basesystem 15 sp60.5.0-150000.3.15.1fixed
Suseumocilinux enterprise module for basesystem 15 sp70.5.0-150000.3.15.1fixed
Suseumocilinux enterprise high performance computing 15 sp3-ltss0.5.0-150000.3.15.1fixed
Suseumocilinux enterprise high performance computing 15 sp4-espos0.5.0-150000.3.15.1fixed
Suseumocilinux enterprise high performance computing 15 sp4-ltss0.5.0-150000.3.15.1fixed
Suseumocilinux enterprise high performance computing 15 sp5-espos0.5.0-150000.3.15.1fixed
Suseumocilinux enterprise high performance computing 15 sp5-ltss0.5.0-150000.3.15.1fixed
Suseumocilinux enterprise server 15 sp3-ltss0.5.0-150000.3.15.1fixed
Suseumocilinux enterprise server 15 sp4-ltss0.5.0-150000.3.15.1fixed
Suseumocilinux enterprise server 15 sp5-ltss0.5.0-150000.3.15.1fixed
Suseumocilinux enterprise server for sap applications 15 sp30.5.0-150000.3.15.1fixed
Suseumocilinux enterprise server for sap applications 15 sp40.5.0-150000.3.15.1fixed
Suseumocilinux enterprise server for sap applications 15 sp50.5.0-150000.3.15.1fixed
Suseumocimanager proxy 4.30.5.0-150000.3.15.1fixed
Suseumocimanager server 4.30.5.0-150000.3.15.1fixed
Suseumocienterprise storage 7.10.5.0-150000.3.15.1fixed
Opensuseumocileap 15.60.5.0-150000.3.15.1fixed
Opensusedockertumbleweed20.10.11_ce-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntucontainerddeb18.041.5.9-0ubuntu1~18.04.1Not reportedUBUNTU-CVE-2021-41190Not reported
Ubuntucontainerddeb20.041.5.9-0ubuntu1~20.04.4Not reportedUBUNTU-CVE-2021-41190Not reported
Ubuntucontainerddeb22.041.5.9-0ubuntu1Not reportedUBUNTU-CVE-2021-41190Not reported
Opensuseumocirpmtumbleweed0.5.0-1.1Not reportedOPENSUSE-SU-2025:15166-1Not reported
Opensusesingularityrpmtumbleweed3.8.5-1.1Not reportedOPENSUSE-SU-2024:11659-1Not reported
Susesingularityrpmpackage hub 15 sp33.8.5-bp153.2.10.1Not reportedOPENSUSE-SU-2021:1525-1Not reported
Opensusesingularityrpmleap 15.33.8.5-bp153.2.10.1Not reportedOPENSUSE-SU-2021:1525-1Not reported
Opensusecontainerdrpmtumbleweed1.4.12-1.1Not reportedOPENSUSE-SU-2024:11646-1Not reported
Susecontainerdrpmlinux enterprise module for containers 121.5.11-16.57.1Not reportedSUSE-SU-2022:1507-1Not reported
Susedockerrpmlinux enterprise module for containers 1220.10.14_ce-98.80.1Not reportedSUSE-SU-2022:1507-1Not reported
Suseumocirpmlinux enterprise module for basesystem 15 sp60.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Suseumocirpmlinux enterprise module for basesystem 15 sp70.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Suseumocirpmlinux enterprise high performance computing 15 sp3-ltss0.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Suseumocirpmlinux enterprise high performance computing 15 sp4-espos0.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Suseumocirpmlinux enterprise high performance computing 15 sp4-ltss0.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Suseumocirpmlinux enterprise high performance computing 15 sp5-espos0.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Suseumocirpmlinux enterprise high performance computing 15 sp5-ltss0.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Suseumocirpmlinux enterprise server 15 sp3-ltss0.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Suseumocirpmlinux enterprise server 15 sp4-ltss0.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Suseumocirpmlinux enterprise server 15 sp5-ltss0.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Suseumocirpmlinux enterprise server for sap applications 15 sp30.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Suseumocirpmlinux enterprise server for sap applications 15 sp40.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Suseumocirpmlinux enterprise server for sap applications 15 sp50.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Suseumocirpmmanager proxy 4.30.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Suseumocirpmmanager server 4.30.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Suseumocirpmenterprise storage 7.10.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Opensuseumocirpmleap 15.60.5.0-150000.3.15.1Not reportedSUSE-SU-2025:02282-1Not reported
Opensusedockerrpmtumbleweed20.10.11_ce-1.1Not reportedOPENSUSE-SU-2024:11647-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[openSUSE Tumbleweed]

  • [containerd]Unknown

    Source package: [containerd]

    Details (1)

    • 1.7.33-1.3 · x86_64 · tumbleweed

      Fixed · Fixed: 1.4.12-1.1

      pypi · containerd · opensuse · tumbleweed

  • [containerd-ctr]Unknown

    Source package: [containerd]

    Details (1)

    • 1.7.33-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.12-1.1

      Version impact unknown

      pypi · containerd · opensuse · tumbleweed

  • [containerd-devel]Unknown

    Source package: [containerd]

    Details (1)

    • 1.7.33-1.3 · noarch · tumbleweed

      Unknown · Fixed: 1.4.12-1.1

      Version impact unknown

      pypi · containerd · opensuse · tumbleweed

  • [docker]Unknown

    Source package: [docker]

    Details (1)

    • 29.4.0_ce-40.3 · x86_64 · tumbleweed

      Fixed · Fixed: 20.10.11_ce-1.1

      pypi · docker · opensuse · tumbleweed

  • [docker-bash-completion]Unknown

    Source package: [docker]

    Details (1)

    • 29.4.0_ce-40.3 · noarch · tumbleweed

      Unknown · Fixed: 20.10.11_ce-1.1

      Version impact unknown

      pypi · docker · opensuse · tumbleweed

  • [docker-buildx]Unknown

    Source package: [docker]

    Details (1)

    • 0.33.0-40.3 · x86_64 · tumbleweed

      Unknown · Fixed: 20.10.11_ce-1.1

      Version impact unknown

      pypi · docker · opensuse · tumbleweed

  • [docker-fish-completion]Unknown

    Source package: [docker]

    Details (1)

    • 29.4.0_ce-40.3 · noarch · tumbleweed

      Unknown · Fixed: 20.10.11_ce-1.1

      Version impact unknown

      pypi · docker · opensuse · tumbleweed

  • [docker-rootless-extras]Unknown

    Source package: [docker]

    Details (1)

    • 29.4.0_ce-40.3 · noarch · tumbleweed

      Unknown · Fixed: 20.10.11_ce-1.1

      Version impact unknown

      pypi · docker · opensuse · tumbleweed

  • [docker-zsh-completion]Unknown

    Source package: [docker]

    Details (1)

    • 29.4.0_ce-40.3 · noarch · tumbleweed

      Unknown · Fixed: 20.10.11_ce-1.1

      Version impact unknown

      pypi · docker · opensuse · tumbleweed

  • [umoci]Unknown

    Source package: [umoci]

    Details (1)

    • 0.6.0-1.7 · x86_64 · tumbleweed

      Fixed · Fixed: 0.5.0-1.1

      pypi · umoci · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]