CVE-2022-24778: Incorrect authorization in github.com/containerd/imgcrypt
Summary
CVE-2022-24778: Incorrect authorization in github.com/containerd/imgcrypt. Affects github.com/containerd/imgcrypt versions < 1.1.4. Fixed in 1.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The imgcrypt library is an extension for containerd that enables support for encrypted container images. It includes the ctd-decoder command line tool, which is used by containerd to decrypt encrypted container images. The library provides the CheckAuthorization function to verify if the current user is authorized to access an encrypted image. However, versions prior to 1.1.4 have a vulnerability that allows unauthorized access to encrypted images under certain conditions.
Vulnerability Detail
The vulnerability in imgcrypt versions prior to 1.1.4 occurs when using an image with a ManifestList and the local host architecture is not the first one in the ManifestList. The CheckAuthorization function only tests the first architecture in the list, which may not have its layers available locally. As a result, the function incorrectly allows the image to run, assuming that any failure due to missing layers will occur later. This enables other architectures in the ManifestList to run the image without providing the necessary decryption keys if the image had been previously decrypted. This vulnerability can lead to unauthorized access to encrypted container images.
How To Fix
Latest published version: v1.1.11 as of 23 Oct 2026
go get github.com/containerd/imgcrypt@v1.1.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.4
This is the first release that contains the fix.
go get github.com/containerd/imgcrypt@v1.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the imgcrypt library is not immediately feasible, a possible workaround is to use different namespaces for each remote user. By isolating the namespaces, the vulnerability can be mitigated to some extent. However, this workaround is not a complete solution and updating to the patched version is still recommended.
Conclusion
The imgcrypt library in versions prior to 1.1.4 has a vulnerability that allows unauthorized access to encrypted container images. It is crucial to update to version 1.1.4 or later to fix this vulnerability. In the meantime, using different namespaces for each remote user can provide some mitigation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containerd/imgcrypt →
FAQ
This vulnerability allows unauthorized access to encrypted container images, potentially exposing sensitive information or allowing malicious actors to run unauthorized images.
Versions prior to 1.1.4 are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file to the playground and it will analyze and alert you if the vulnerability is present.
Yes, a patch has been released in version 1.1.4 of the imgcrypt library. It is recommended to update to this version to fix the vulnerability.
A possible workaround is to use different namespaces for each remote user. However, this is not a complete solution and updating to the patched version is still recommended.
