Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update: docker #1546

Closed
dongsupark opened this issue Sep 20, 2024 · 0 comments · Fixed by flatcar/scripts#2317
Closed

update: docker #1546

dongsupark opened this issue Sep 20, 2024 · 0 comments · Fixed by flatcar/scripts#2317
Labels
advisory security advisory cvss/CRITICAL >= 9 assessed CVSS security security concerns

Comments

@dongsupark
Copy link
Member

dongsupark commented Sep 20, 2024

Name: docker
CVEs: CVE-2024-41110
CVSSs: 9.9
Action Needed: update to >= v26.1.5 or >= v27.1.1

Summary: A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low. Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it. A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted. Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable. docker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.

See also https://bugzilla.redhat.com/show_bug.cgi?id=2299720, GHSA-v23v-6jw2-98fq.

refmap.gentoo: TBD

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
advisory security advisory cvss/CRITICAL >= 9 assessed CVSS security security concerns
Projects
Development

Successfully merging a pull request may close this issue.

1 participant