Docker-Security

Docker Security これはOWASP Docker Top 10です。作業中のドキュメントです。 このドキュメントについて このドキュメントは、セキュアなコンテナ化環境を構築するための最も重要な10のセキュリティ項目を説明しています。ゼロから始める場合の仕様書として使用でき、また、この作業を委託する業者に渡すこともできます。...

vulnerable-container-hub

OWASP 취약 컨테이너 허브 프로젝트 배경 보안을 배우고자 하는 사람들에게 웹 애플리케이션, 컨테이너 또는 가상 머신과 같은 취약 환경을 제공하는 저장소는 많이 있습니다. 이러한 환경은 해당 분야에 갓 입문한 학생이나 신입이 관련 보안 기술을 배우는 데 도움이 될 뿐만 아니라, 보안 전문가가 실무 감각을 유지하는 데에도 도움이 되기 때문입니다. 이러한 접근 방식 중 요즘 가장 쉬운 방법은 컨테이너예: docker 또는 podman를 사용하는 것입니다. docker run 또는 docker compose up과 같은 단 하나의...

dockerscan

DockerScan v2.0 Lo scanner di sicurezza Docker più completo...

dockerscan

DockerScan v2.0 The Most Comprehensive Docker Security Scanner | |...

dockle

Dockle - Linter per immagini container per la sicurezza, aiuta a costruire l'immagine Docker secondo le migliori pratiche, facile da iniziare Dockle ti aiuta: 1. Costruire immagini Docker Best Practice 2. Costruire immagini Docker sicure I checkpoint includono CIS Benchmarksbash $ brew untap...

CVE-2026-55581

mcp-shell is an MCP server for running shell commands securely. Prior to 0.6.0 , the default Docker security.yaml includes /bin/bash in allowed_executables, while security.go validates only the first token and checkBlockedPatternsAndCommands does not reject the shell -c flag. A caller of the shel...

PT-2026-81351

Name of the Vulnerable Software and Affected Versions mcp-shell versions prior to 0.6.0 Description An OS command injection issue exists in the shell exec MCP tool. The software implements a secure mode that restricts command execution to an allowlist defined in security.yaml. However, the defaul...

EUVD-2026-31484

The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation ECI restrictions in Docker Desktop. When ECI is enabled, Docker socket mounts from containers are denied unless explicitly allowed via the admin-settings configuration. However, the --use-api-socket flag adds the Docker...

Docker: `PUT /containers/{id}/archive` executes container binary on the host

Summary When a user uploads a compressed archive into a container, a malicious image can execute arbitrary code with daemon host root privileges. Details When handling PUT /containers/id/archive requests with compressed archives, the daemon decompresses them using external system binaries. Due to...

PT-2026-41036

Name of the Vulnerable Software and Affected Versions Portainer Community Edition versions 2.33.0 through 2.33.7 Portainer Community Edition versions 2.39.0 through 2.39.1 Portainer Community Edition versions 2.40.0 through 2.40.x Portainer Community Edition versions prior to 2.33.0 Description...

EUVD-2020-21940

Malware in sbrugna...

EUVD-2019-0160

Malware in sbrugna...

EUVD-2024-52170

Malicious code in bioql PyPI...

CVE-2025-54410 Moby's Firewalld reload removes bridge network isolation

Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails to re-create...

SUSE-SU-2025:02366-2 Security update for docker

This update for docker fixes the following issues: Update to Docker 28.2.2-ce bsc1243833, bsc1242114: - CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction bsc1241830. Other bugfixes: - Always clear SUSEConnect sus...

CVE-2025-53372

CVE-2025-53372 concerns the node-code-sandbox-mcp MCP Server (Node.js) prior to version 1.3.0, which is vulnerable to command injection through unsanitized input used in a call to a shell command via child_process.execSync. Exploitation can allow remote code execution with the server process’s pr...

PT-2025-25764 · Unknown +3 · Portainer Community Edition +4

Name of the Vulnerable Software and Affected Versions: Portainer Community Edition versions prior to 2.31.0 STS and prior to 2.27.7 LTS Description: The issue affects a lightweight service delivery platform for containerized applications, allowing management of Docker, Swarm, Kubernetes, and ACI...

SUSE-SU-2025:20393-1 Security update for docker

This update for docker fixes the following issues: Always clear SUSEConnect suse secrets when starting containers regardless of whether the daemon was built with SUSEConnect support. Not doing this causes containers from SUSEConnect-enabled daemons to fail to start when running with...

PT-2025-20883 · Undefined · Undefined

2025-05-13 19:01:23.477089 UTC +09:00 1. CVE-2025-41645 CERTVDE SMA: Sunny Portal demo system privilege escalation An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake. https://vulners.com/cve/CVE-2025-41645...

Important: docker

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...