9929 matches found
GHSA-QRQR-3X5J-2XW9 Docker Authentication Bypass
An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root...
GHSA-6FJ5-M822-RQX8 moby docker daemon crash during image pull of malicious image
Impact Pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Patches Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing. Credits Maintainers would like to thank Josh Larsen, Ian Coldwater, Duffie Cooley, Rory McCune for working on th...
moby Access to remapped root allows privilege escalation to real root
Impact When using --userns-remap, if the root user in the remapped namespace has access to the host filesystem they can modify files under /var/lib/docker/ that cause writing files with extended privileges. Patches Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation fr...
GHSA-7452-XQPJ-6RPC moby Access to remapped root allows privilege escalation to real root
Impact When using --userns-remap, if the root user in the remapped namespace has access to the host filesystem they can modify files under /var/lib/docker/ that cause writing files with extended privileges. Patches Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation fr...
Path Traversal in Moby builder
util/binfmtmisc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call...
GHSA-6HWG-W5JG-9C6X Path Traversal in Moby builder
util/binfmtmisc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call...
GHSA-XR7R-F8XQ-VFVV runc vulnerable to container breakout through process.cwd trickery and leaked fds
Impact In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process from runc exec to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem "attack 2". Th...
GHSA-M3R6-H7WV-7XXV vulnerabilities
Vulnerabilities for packages: buildkitd, docker, skaffold, kubescape, guac, trivy, zot, conftest, kaniko, scorecard...
GHSA-4V98-7QMW-RQR8 vulnerabilities
Vulnerabilities for packages: kubescape, conftest-fips, docker, conftest, zot, skaffold, guac, trivy, kaniko, scorecard, buildkitd...
GHSA-4V98-7QMW-RQR8 vulnerabilities
Vulnerabilities for packages: buildkitd, docker, skaffold, kubescape, guac, trivy, zot, conftest, kaniko, scorecard...
CVE-2024-23651 vulnerabilities
Vulnerabilities for packages: buildkitd, docker, skaffold, kubescape, guac, trivy, zot, conftest, kaniko, scorecard...
CVE-2024-23651 vulnerabilities
Vulnerabilities for packages: kubescape, conftest-fips, docker, conftest, zot, skaffold, guac, trivy, kaniko, scorecard, buildkitd...
CVE-2024-23652 vulnerabilities
Vulnerabilities for packages: buildkitd, docker, skaffold, kubescape, guac, trivy, zot, conftest, kaniko, scorecard...
CVE-2024-23652 vulnerabilities
Vulnerabilities for packages: kubescape, conftest-fips, docker, conftest, zot, skaffold, guac, trivy, kaniko, scorecard, buildkitd...
AZL-35433 CVE-2024-23653 affecting package docker-buildx for versions less than 0.14.0-1
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask...
AZL-35439 CVE-2024-23653 affecting package docker-compose for versions less than 2.27.0-1
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask...
CVE-2024-23653 vulnerabilities
Vulnerabilities for packages: kubescape, conftest-fips, docker, conftest, zot, skaffold, guac, trivy, kaniko, scorecard, buildkitd...
CVE-2024-23653 vulnerabilities
Vulnerabilities for packages: buildkitd, docker, skaffold, kubescape, guac, trivy, zot, conftest, kaniko, scorecard...