Mobyproject Docker Moby

moby/moby's dockerd daemon encrypted overlay network may be unauthenticated

moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.

Moby classic builder cache poisoning

An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA (as opposed to one signed by the configured CA root certificate) to authenticate.

External DNS requests from 'internal' networks could lead to data exfiltration

Moby: Race condition in docker cp allows bind mount redirection to host path

moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated

moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted

moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.

moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.

Moby IPv6 enabled on IPv4-only network interfaces

Insufficiently restricted permissions on data directory in Docker Engine

The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.

Moby vulnerability relating to supplementary group permissions

`docker cp` allows unexpected chmod of host files

Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.

Default inheritable capabilities for linux container should be empty

A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

Moby's Firewalld reload removes bridge network isolation

Moby's Firewalld reload makes published container ports accessible from remote hosts