OESA-2024-2555 docker security update

Docker is an open source project to build, ship and run any application as a lightweight container. Security Fixes: moby v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or...

moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.

...

moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.

...

moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.

...

AZL-54320 CVE-2024-45337 affecting package moby-engine for versions less than 24.0.9-13

Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...

AZL-54357 CVE-2024-45337 affecting package moby-engine for versions less than 25.0.3-9

Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...

AZL-54286 CVE-2024-45337 affecting package moby-compose for versions less than 2.17.3-9

Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...

CVE-2024-36621 affecting package moby-engine for versions less than 25.0.3-8

CVE-2024-36621 affecting package moby-engine for versions less than 25.0.3-8. A patched version of the package is available...

CVE-2024-36623 affecting package moby-engine for versions less than 25.0.3-8

CVE-2024-36623 affecting package moby-engine for versions less than 25.0.3-8. A patched version of the package is available...

CVE-2024-36620 affecting package moby-engine for versions less than 25.0.3-8

CVE-2024-36620 affecting package moby-engine for versions less than 25.0.3-8. A patched version of the package is available...

ROS-20241212-03

A vulnerability in the Moby container platform exists due to an error deleting a NULL pointer in the daemon/images/imagehistory.go. Exploitation of the vulnerability could allow an attacker to cause the application to crash. of the application...

GO-2024-3311 NULL Pointer Dereference on moby image history in github.com/moby/moby

NULL Pointer Dereference on moby image history in github.com/moby/moby...

OESA-2024-2527 docker security update

Docker is an open source project to build, ship and run any application as a lightweight container. Security Fixes: moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLay...

OESA-2024-2526 docker security update

Docker is an open source project to build, ship and run any application as a lightweight container. Security Fixes: moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLay...

OESA-2024-2525 docker security update

Docker is an open source project to build, ship and run any application as a lightweight container. Security Fixes: moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLay...

OESA-2024-2507 moby security update

Docker is a product for you to build, ship and run any application as a lightweight container. Security Fixes: moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/imagehistory.go.CVE-2024-36620 moby v25.0.5 is affected by a Race Condition in...

CVE-2024-24786 affecting package moby-engine for versions less than 25.0.3-7

CVE-2024-24786 affecting package moby-engine for versions less than 25.0.3-7. A patched version of the package is available...

CVE-2024-24786 affecting package moby-containerd-cc for versions less than 1.7.7-5

CVE-2024-24786 affecting package moby-containerd-cc for versions less than 1.7.7-5. A patched version of the package is available...

SUSE CVE-2024-36620

moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/imagehistory.go...

SUSE CVE-2024-36621

moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion...