Resource To Wrong Sphere

2024-04-1907:01:40

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github

docker

network security

ipv6

vulnerability

4.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

github.com/docker/docker is vulnerable to Exposure of Resource to Wrong Sphere. The vulnerability is due to IPv6 being enabled on network interfaces, even in configurations where --ipv6=false is specified. The impact of this flaw is containers can communicate with other hosts on the local network over IPv6, containers may receive a SLACC assigned address, and the interface will be apart of IPv6 multicast groups.

CPENameOperatorVersion
github.com/docker/dockerlev26.0.1
github.com/moby/mobylev26.0.1
github.com/docker/dockerlev26.0.1
github.com/moby/mobylev26.0.1
docker:edgeeq23.0.6-r3
docker:edgeeq20.10.21-r1
docker:edgeeq23.0.0-r0
docker:edgeeq20.10.17-r0
docker:edgeeq20.10.22-r0
docker:edgeeq20.10.10-r0

Name	Operator	Version
github.com/docker/docker	le	v26.0.1
github.com/moby/moby	le	v26.0.1
github.com/docker/docker	le	v26.0.1
github.com/moby/moby	le	v26.0.1
docker:edge	eq	23.0.6-r3
docker:edge	eq	20.10.21-r1
docker:edge	eq	23.0.0-r0
docker:edge	eq	20.10.17-r0
docker:edge	eq	20.10.22-r0
docker:edge	eq	20.10.10-r0