Improper Input Validation

Summary

A bug was found in containerd where the CRI plugin propagates labels from an image config ('LABEL' instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue affects containerd versions from 1.7.0 prior to 1.7.33, 2.0.0 prior to 2.0.10, 2.1.0 prior to 2.1.9, 2.2.0 prior to 2.2.5 and 2.3.0 prior to 2.3.2.