99 matches found
OPENSUSE-SU-2024:11647-1 docker-20.10.11_ce-1.1 on GA media
These are all security issues fixed in the docker-20.10.11ce-1.1 package on the GA media of openSUSE Tumbleweed...
GO-2024-2913 Unexpected chmod of host files via 'docker cp' in Moby Docker Engine in github.com/docker/docker
Unexpected chmod of host files via 'docker cp' in Moby Docker Engine in github.com/docker/docker...
SUSE-SU-2024:0586-2 Security update for docker
This update for docker fixes the following issues: Vendor latest buildkit v0.11 including bugfixes for the following: CVE-2024-23653: BuildKit API doesn't validate entitlement on container creation bsc1219438. CVE-2024-23652: Fixed arbitrary deletion of files bsc1219268. CVE-2024-23651: Fixed rac...
SUSE-SU-2024:0587-1 Security update for docker
This update for docker fixes the following issues: Vendor latest buildkit v0.11 including bugfixes for the following: CVE-2024-23653: BuildKit API doesn't validate entitlement on container creation bsc1219438. CVE-2024-23652: Fixed arbitrary deletion of files bsc1219268. CVE-2024-23651: Fixed rac...
SUSE-SU-2024:0586-1 Security update for docker
This update for docker fixes the following issues: Vendor latest buildkit v0.11 including bugfixes for the following: CVE-2024-23653: BuildKit API doesn't validate entitlement on container creation bsc1219438. CVE-2024-23652: Fixed arbitrary deletion of files bsc1219268. CVE-2024-23651: Fixed rac...
@lobehub/chat vulnerable to unauthorized access to plugins
Description: When the application is password-protected deployed with the ACCESSCODE option, it is possible to access plugins without proper authorization without password. Proof-of-Concept: Let’s suppose that application has been deployed with following command: sudo docker run -d -p 3210:3210 -...
Important: docker
Issue Overview: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...
SUSE-SU-2023:3307-1 Security update for docker
This update for docker fixes the following issues: - Update to v20.10.25-ce - CVE-2023-28840: Fixed a bug where an attacker could inject arbitrary Ethernet frames to execute a Denial of Service attack. bsc1214107 - CVE-2023-28841: Fixed a bug which allows an attacker to sit in a trusted position ...
SUSE SLES12 Security Update : docker (SUSE-SU-2023:1625-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:1625-1 advisory. - CVE-2022-36109: Fixed a supplementary group permissions bypass bsc1205375. Update to 20.10.23-ce...
GHSA-HQWH-8XV9-42HW tar-split memory exhaustion
Lack of content verification in Docker-CE Also known as Moby versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing...
SUSE-SU-2022:1689-1 Security update for containerd, docker
This update for containerd, docker fixes the following issues: - CVE-2022-24769: Fixed incorrect default inheritable capabilities bsc1197517. - CVE-2022-23648: Fixed directory traversal issue bsc1196441. - CVE-2022-27191: Fixed a crash in a golang.org/x/crypto/ssh server bsc1197284. -...
Privilege Escalation in Docker
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors...
SUSE-SU-2022:0334-1 Security update for containerd, docker
This update for containerd, docker fixes the following issues: - CVE-2021-41089: Fixed 'cp' can chmod host files bsc1191015. - CVE-2021-41091: Fixed flaw that could lead to data directory traversal in moby bsc1191434. - CVE-2021-41092: Fixed exposed user credentials with a misconfigured...
Security update for containerd, docker (moderate)
openSUSE Security Update: Security update for containerd, docker Announcement ID: openSUSE-SU-2022:0334-1 Rating: moderate References: 1191015 1191121 1191334 1191434 1193273 Cross-References: CVE-2021-41089 CVE-2021-41091 CVE-2021-41092 CVE-2021-41103 CVE-2021-41190 CVSS scores: CVE-2021-41089 N...
Information Disclosure
docker is vulnerable to information disclosure. A security regression of CVE-2016-9962 due to inclusion of vulnerable runc allows an attacker to obtain confidential information...
Exploit for OS Command Injection in Docker
RunC-CVE-2019-5736 --- Video: https://bit.ly/2WqvIL...
Poorly Secured Docker Image Comes Under Rapid Attack
In a vivid example of why cloud infrastructure needs strong security, a simple Docker container honeypot was used for four different criminal campaigns in the span of 24 hours, in a recent lab test. Akamai security researcher Larry Cashdollar set up the Docker image to see what kind of notice it...
LibMiner: Container-Based Cryptocurrency Miner Targeting Unprotected Redis Servers
Qualys is actively tracking threats which target containers. In our recent analysis, we have identified a few docker instances executing a malware which we term as “LibMiner”. This malware has the capability to deploy and execute Cryptominer. It uses a unique technique for lateral movement across...
