Clarify Content-Type handling in OCI spec
Priority LOW 27CWE-843Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 6 fixed, 8 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.
Why it matters now
EPSS 0.02223 82nd percentileScored 2026-11-07
Fix Partial distribution-spec (opencontainers): 1.0.1github.com/opencontainers/distribution-spec (Go): 1.0.1Red Hat: 9 advisoriesRed Hat: 6 fixed, 8 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | distribution-spec | before 1.0.1 | 1.0.1 | Patch available | CNA |
| — | github.com/opencontainers/distribution-spec (Go) | before 1.0.1 | 1.0.1 | Patch available | GHSA-mc8v-mgrf-8f4m |
- distribution-spec Vendorbackstage Affected before 1.0.1 Fixed in 1.0.1 Patch available CNA
- github.com/opencontainers/distribution-spec (Go) Vendor— Affected before 1.0.1 Fixed in 1.0.1 Patch available GHSA-mc8v-mgrf-8f4m
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:open_container_initiative_distribution_specification:*:*:*:*:*:*:*:* | up to 1.0.0 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:open_container_initiative_image_format_specification:*:*:*:*:*:*:*:* | up to 1.0.1 | Vulnerable | backstage |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
- cpe:2.3:a:linuxfoundation:open_container_initiative_distribution_specification:*:*:*:*:*:*:*:* Versions up to 1.0.0 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:open_container_initiative_image_format_specification:*:*:*:*:*:*:*:* Versions up to 1.0.1 Vulnerable ·backstage
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA distribution-spec (opencontainers) Fixed in 1.0.1
- Fix · GHSA-mc8v-mgrf-8f4m github.com/opencontainers/distribution-spec (Go) Fixed in 1.0.1 Advisory →
Red Hat 9 advisories
- RHSA-2022:7457 Released 2022-11-08 · Red Hat rating Moderatecontainer-tools:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.aarch64::container-tools:rhel8, aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.ppc64le::container-tools:rhel8, aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.s390x::container-tools:rhel8 +47
- RHSA-2022:5069 Released 2022-08-10 · Red Hat rating ImportantOpenShift Container Platform 4.11.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8, openshift4/ose-alibaba-machine-controllers-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8 +47
- RHSA-2022:4956 Released 2022-06-09 · Red Hat rating ImportantRed Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/acm-cluster-proxy-rhel8, rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8 +47
Show 6 more Red Hat advisories
- RHSA-2022:4880 Released 2022-06-02 · Red Hat rating ModerateACS 3.70 enhancement and security update
- RHACS 3.70 for RHEL 8 advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8, advanced-cluster-security/rhacs-docs-rhel8 +3
- RHSA-2022:4668 Released 2022-05-18 · Red Hat rating ModerateOpenShift Virtualization 4.10.1 Images security and bug fix update
- CNV 4.10 for RHEL 8 container-native-virtualization/hostpath-csi-driver, container-native-virtualization/hostpath-csi-driver-rhel8
- RHSA-2022:1734 Released 2022-05-05 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.1 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-velero-rhel8
- RHSA-2022:1476 Released 2022-04-21 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.4.3 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
- RHSA-2022:0055 Released 2022-03-10 · Red Hat rating ModerateOpenShift Container Platform 4.10.3 bug fix and security update
- Red Hat OpenShift Container Platform 4.10 coreos-installer-0.12.0-1.rhaos4.10.el8, coreos-installer-bootinfra-0.12.0-1.rhaos4.10.el8, cri-o-1.23.0-92.rhaos4.10.gitdaab4d1.el7 +11
- RHSA-2022:0687 Released 2022-02-28 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.0.1 security and bug fix update
- 8Base-OADP-1.0 oadp/oadp-registry-rhel8, oadp/oadp-velero-plugin-rhel8
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform Assisted Installer 1 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Virtualization 2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| 8Base-OADP-1.0 | Fixed | RHSA-2022:0687 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2022:1734 |
| RHACS 3.70 for RHEL 8 | Fixed | RHSA-2022:4880 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:7457 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2022:0055 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2022:5069 |
Not affected: 8 products
- 8Base-OADP-1.0
- 8Base-RHMTC-1.7
- RHACS 3.70 for RHEL 8
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.10
- Red Hat OpenShift Container Platform 4.11
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41190
- 2026-10-03 Alias added: GHSA-mc8v-mgrf-8f4m
References
Patch 1
Advisory 11
- https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m
- [oss-security] 20211119 CVE-2021-41190 OCI distribution and image spec: "content-type" confusion
- FEDORA-2021-d250fc2622
- FEDORA-2021-6dc68dbe4d
- FEDORA-2021-79ba5abef6
- FEDORA-2021-eb2742b148
- FEDORA-2021-3dda301691
- FEDORA-2021-aacef7fa15
- FEDORA-2021-62352983b4
- FEDORA-2021-6789ed60f2
- https://nvd.nist.gov/vuln/detail/CVE-2021-41190
Other 9
- https://github.com/opencontainers/distribution-spec
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3TUZNDAH2B26VPBK342UC3BHZNLBUXGX
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4334HT7AZPLWNYHW4ARU6JBUF3VZJPZN
- https://lists.fedoraproject.org/archives/list/[email protected]/message/A2RRFNTMFYKOTRKD37F5ANMCIO3GGJML
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DX63GRWFEI5RVMYV6XLMCG4OHPWZML27
- https://lists.fedoraproject.org/archives/list/[email protected]/message/RZTO6N55WHKHIZI4IMLY2QFBPMVTAERM
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SQBCYJUIM5GVCMFUPRWKRZNXMMI5EFA4
- https://lists.fedoraproject.org/archives/list/[email protected]/message/T4OJ764CKKCWCVONHD4YXTGR7HZ7LRUV
- https://lists.fedoraproject.org/archives/list/[email protected]/message/YIGVQWOA5XXCQXEOOKZX4CDAGLBDRPRX
Sources
- CVE-2021-41190 · CVE Program
- CVE-2021-41190 · NVD
- FIRST EPSS
- GHSA-mc8v-mgrf-8f4m · GitHub Advisory Database · CC BY 4.0
- CVE-2021-41190 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences