[{"uuid":"GSA_kwCzR0hTQS1yZzJ4LTM3YzMtdzJyaM4ABXBb","url":"https://github.com/advisories/GHSA-rg2x-37c3-w2rh","title":"Docker: Race condition in docker cp allows bind mount redirection to host path","description":"## Summary\n\nA race condition during `docker cp` mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service.\n\n## Details\n\nWhen copying files into a container, the daemon sets up a temporary filesystem view by bind-mounting volumes into a private mount namespace. During this setup, the mount destination is created inside the container root and then a bind mount is attached using the container-relative path resolved to an absolute host path.\n\nBetween mountpoint creation and the `mount()` syscall, a process running inside the container can replace the destination (or a parent path component) with a symlink pointing to an arbitrary location on the host. The `mount()` syscall follows the symlink, causing the volume to be bind-mounted onto an arbitrary host path instead of the intended container path.\n\n## Impact\n\nA malicious container can redirect a volume bind mount to an arbitrary host path. The impact depends on the volume content and mount options:\n\n- If the volume is writable, arbitrary host files at the redirected path could be overwritten with the volume's contents.\n- If the volume is read-only, the host path is masked by the mount for the duration of the operation, causing denial of service.\n- In all cases the mount is temporary (torn down after the `docker cp` completes), but the effects of any writes persist.\n\n### Conditions for exploitation\n\n- A container must have at least one volume mount.\n- A process inside the container must be able to rapidly create and swap symlinks at the volume mount destination path.\n- An operator must initiate a `docker cp` into that container, or call the `PUT /containers/{id}/archive` or `HEAD /containers/{id}/archive` API endpoints.\n\n### Not affected\n\n- Containers that do not have volume mounts are not affected, as the race occurs during volume bind-mount setup.\n\n## Workarounds\n\n- Only run containers from trusted images.\n- Avoid using `docker cp` with untrusted running containers.\n- Use authorization plugins to restrict access to the archive API endpoints (`PUT /containers/{id}/archive`, `HEAD /containers/{id}/archive`).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-05-18T17:53:08.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.2,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","references":["https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh","https://nvd.nist.gov/vuln/detail/CVE-2026-42306","https://github.com/advisories/GHSA-rg2x-37c3-w2rh"],"source_kind":"github","identifiers":["GHSA-rg2x-37c3-w2rh","CVE-2026-42306"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-18T18:00:17.572Z","updated_at":"2026-10-16T06:03:24.859Z","epss_percentage":0.001,"epss_percentile":0.00777,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yZzJ4LTM3YzMtdzJyaM4ABXBb","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yZzJ4LTM3YzMtdzJyaM4ABXBb","packages":[{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 28.5.2"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"},{"ecosystem":"go","package_name":"github.com/moby/moby/v2","versions":[{"first_patched_version":"2.0.0-beta.14","vulnerable_version_range":"\u003c 2.0.0-beta.14"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby%2Fv2"},{"ecosystem":"go","package_name":"github.com/docker/docker","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 28.5.2"}],"purl":"pkg:go/github.com%2Fdocker%2Fdocker"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yZzJ4LTM3YzMtdzJyaM4ABXBb/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12cDYyLTg4cDctcXFmNc4ABXBa","url":"https://github.com/advisories/GHSA-vp62-88p7-qqf5","title":"Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap","description":"## Summary\n\nA race condition during `docker cp` mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem.\n\nThis advisory covers the race during mountpoint creation. The related race during the subsequent mount syscall is tracked in GHSA-rg2x-37c3-w2rh\n\n## Details\n\nWhen copying files into a container, the daemon sets up a temporary filesystem view by bind-mounting volumes into a private mount namespace. During this setup, the mount destination path is first resolved within the container's root filesystem using `GetResourcePath`, and then used to create the mountpoint (file or directory) if it does not already exist via `createIfNotExists`.\n\nBetween path resolution and mountpoint creation, a process running inside the container can swap a path component for a symlink pointing to an arbitrary location on the host. Because `createIfNotExists` operates on the already-resolved absolute path using standard `os.MkdirAll` and `os.OpenFile` — which follow symlinks in intermediate path components — the symlink is followed and the file or directory is created outside the container root filesystem, as root.\n\n## Impact\n\nA malicious container can create empty files or directories at arbitrary absolute paths on the host filesystem, running as root. This enables persistent denial of service — for example:\n\n- Converting `/etc/docker/daemon.json` into a directory prevents the daemon from restarting\n- Creating `/etc/nologin` prevents user logins\n- Overwriting critical system paths with empty files can break host services\n\nThe container does not gain read or write access to existing host files — only the ability to create new empty files or directories at chosen paths.\n\n### Conditions for exploitation\n\n- A container must be running with a process that can rapidly create and swap symlinks at a volume mount destination path.\n- An operator must initiate a `docker cp` into that container, or call the `PUT /containers/{id}/archive` or `HEAD /containers/{id}/archive` API endpoints.\n\n### Not affected\n\n- Containers that do not have volume mounts are not affected, as the race occurs during volume bind-mount setup.\n\n## Patches\n\nMountpoint creation is now scoped to the container root using `os.Root` (Go 1.24+), which refuses to follow symlinks that escape the opened root directory. All filesystem operations in `createIfNotExists` (`MkdirAll`, `OpenFile`) are performed through the `os.Root` handle, so even if a symlink swap occurs after path resolution, the creation stays confined to the container root.\n\n## Workarounds\n\n- Only run containers from trusted images.\n- Avoid using `docker cp` with untrusted running containers.\n- Use authorization plugins to restrict access to the archive API endpoints (`PUT /containers/{id}/archive`, `HEAD /containers/{id}/archive`).","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-05-18T17:52:55.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.1,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H","references":["https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5","https://nvd.nist.gov/vuln/detail/CVE-2026-41568","https://github.com/advisories/GHSA-vp62-88p7-qqf5"],"source_kind":"github","identifiers":["GHSA-vp62-88p7-qqf5","CVE-2026-41568"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-18T18:00:17.572Z","updated_at":"2026-10-16T06:03:24.861Z","epss_percentage":0.00098,"epss_percentile":0.0071,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12cDYyLTg4cDctcXFmNc4ABXBa","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12cDYyLTg4cDctcXFmNc4ABXBa","packages":[{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 28.5.2"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"},{"ecosystem":"go","package_name":"github.com/moby/moby/v2","versions":[{"first_patched_version":"2.0.0-beta.14","vulnerable_version_range":"\u003c 2.0.0-beta.14"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby%2Fv2"},{"ecosystem":"go","package_name":"github.com/docker/docker","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 28.5.2"}],"purl":"pkg:go/github.com%2Fdocker%2Fdocker"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12cDYyLTg4cDctcXFmNc4ABXBa/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14ODZmLTV4dzItZm0ycs4ABXBV","url":"https://github.com/advisories/GHSA-x86f-5xw2-fm2r","title":"Docker: `PUT /containers/{id}/archive` executes container binary on the host","description":"## Summary\n\nWhen a user uploads a compressed archive into a container, a malicious image can execute arbitrary code with daemon (host root) privileges.\n\n## Details\n\nWhen handling `PUT /containers/{id}/archive` requests with compressed archives, the daemon decompresses them using external system binaries. Due to incorrect ordering of operations, these binaries are resolved from the container's filesystem rather than the host's. A container image that includes a trojanized decompression binary can achieve code execution as the daemon process whenever a compressed archive is uploaded to that container.\n\nThe executed binary runs with the daemon's full privileges, including host root UID and unrestricted capabilities.\n\n## Impact\n\nArbitrary code execution as host root, crossing the container-to-host trust boundary.\n\n### Conditions for exploitation\n\n- A user must run a container from a malicious image that contains a trojanized decompression binary.\n- The user must then upload a compressed archive (xz or gzip) into that container, either by piping a compressed archive via `docker cp -` or by calling the `PUT /containers/{id}/archive` API directly with compressed content.\n\n### Not affected\n\nStandard `docker cp` usage is **not** affected, because the CLI sends uncompressed tar by default:\n\n```\ndocker cp ./file.txt mycontainer:/file.txt\n```\n\nThis can only be exploited when explicitly passing a xz or gzip-compressed archive to `docker cp` or the `PUT /containers/{id}/archive` API, for example:\n\n```\ncat archive.tar.xz | docker cp - mycontainer:/dir\n```\n\nDecompression formats using pure Go implementations (bzip2, zstd, and gzip when the container image does not contain an `unpigz` binary) are also not affected.\n\n## Workarounds\n\n- Only run containers from trusted images.\n- Use authorization plugins to limit access to the `PUT /containers/{id}/archive` endpoint.\n- Avoid piping compressed archives into containers created from untrusted images.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-05-18T17:47:23.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.2,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","references":["https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r","https://nvd.nist.gov/vuln/detail/CVE-2026-41567","https://github.com/advisories/GHSA-x86f-5xw2-fm2r"],"source_kind":"github","identifiers":["GHSA-x86f-5xw2-fm2r","CVE-2026-41567"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-18T18:00:17.573Z","updated_at":"2026-10-16T06:03:24.865Z","epss_percentage":0.00155,"epss_percentile":0.0418,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14ODZmLTV4dzItZm0ycs4ABXBV","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14ODZmLTV4dzItZm0ycs4ABXBV","packages":[{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 28.5.2"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"},{"ecosystem":"go","package_name":"github.com/docker/docker","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 28.5.2"}],"purl":"pkg:go/github.com%2Fdocker%2Fdocker"},{"ecosystem":"go","package_name":"github.com/moby/moby/v2","versions":[{"first_patched_version":"2.0.0-beta.14","vulnerable_version_range":"\u003c 2.0.0-beta.14"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14ODZmLTV4dzItZm0ycs4ABXBV/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14NzQ0LTR3cGMtdjloMs4ABUYb","url":"https://github.com/advisories/GHSA-x744-4wpc-v9h2","title":"Moby has AuthZ plugin bypass when provided oversized request bodies","description":"## Summary\n\nA security vulnerability has been detected that allows attackers to bypass [authorization plugins (AuthZ)](https://docs.docker.com/engine/extend/plugins_authorization/) under specific circumstances. The base likelihood of this being exploited is low.\n\nThis is an incomplete fix for [CVE-2024-41110](https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq).\n\n## Impact\n\n**If you don't use AuthZ plugins, you are not affected.**\n\nUsing a specially-crafted API request, an attacker could make the Docker daemon forward the request to an authorization plugin without the body. The authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.\n\nAnyone who depends on authorization plugins that introspect the request body to make access control decisions is potentially impacted.\n\n## Workarounds\n\nIf unable to update immediately:\n- Avoid using AuthZ plugins that rely on request body inspection for security decisions.\n- Restrict access to the Docker API to trusted parties, following the principle of least privilege.\n\n## Credits\n\n- 1seal / Oleh Konko ([@1seal](https://github.com/1seal))\n- Cody (c@wormhole.guru)\n- Asim Viladi Oglu Manizada (@manizada)\n\n## Resources\n\n- [CVE-2024-41110 / GHSA-v23v-6jw2-98fq](https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq)","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-27T17:43:16.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.8,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":["https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq","https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2","https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38","https://docs.docker.com/engine/extend/plugins_authorization","https://nvd.nist.gov/vuln/detail/CVE-2026-34040","https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://github.com/advisories/GHSA-x744-4wpc-v9h2"],"source_kind":"github","identifiers":["GHSA-x744-4wpc-v9h2","CVE-2026-34040"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-27T18:00:09.113Z","updated_at":"2026-10-17T05:09:26.488Z","epss_percentage":0.00163,"epss_percentile":0.04852,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14NzQ0LTR3cGMtdjloMs4ABUYb","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14NzQ0LTR3cGMtdjloMs4ABUYb","packages":[{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":"29.3.1","vulnerable_version_range":"\u003c 29.3.1"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"},{"ecosystem":"go","package_name":"github.com/moby/moby/v2","versions":[{"first_patched_version":"2.0.0-beta.8","vulnerable_version_range":"\u003c 2.0.0-beta.8"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby%2Fv2"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14NzQ0LTR3cGMtdjloMs4ABUYb/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1weHE2LTJwcnctY2hqOc4ABUYa","url":"https://github.com/advisories/GHSA-pxq6-2prw-chj9","title":"Moby has an Off-by-one error in its plugin privilege validation","description":"## Summary\n\nA security vulnerability has been detected that allows [plugins](https://docs.docker.com/engine/extend/legacy_plugins/) privilege validation to be bypassed during `docker plugin install`. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user.\n\nPlugins that request exactly one privilege are also affected, because no comparison is performed at all.\n\n## Impact\n\n**If plugins are not in use, there is no impact.**\n\nWhen a plugin is installed, the daemon computes the privileges required by the plugin's configuration and compares them with the privileges approved during installation. A malicious plugin can exploit this bug so that the daemon accepts privileges that differ from what was intended to be approved.\n\nAnyone who depends on the plugin installation approval flow as a meaningful security boundary is potentially impacted.\n\nDepending on the privilege set involved, this may include highly sensitive plugin permissions such as broad device access.\n\n**For consideration: exploitation still requires a plugin to be installed from a malicious source, and Docker plugins are relatively uncommon. Docker Desktop also does not support plugins.**\n\n## Workarounds\n\nIf unable to update immediately:\n- Do not install plugins from untrusted sources\n- Carefully review all privileges requested during `docker plugin install`\n- Restrict access to the Docker daemon to trusted parties, following the principle of least privilege\n- Avoid relying on plugin privilege approval as the only control boundary for sensitive environments\n\n## Credits\n\n- Reported by Cody (c@wormhole.guru, PGP 0x9FA5B73E)","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-03-27T17:38:09.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.8,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","references":["https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9","https://github.com/moby/moby/commit/f4d6f25bf0c3fa12d4968320a45685947756a22a","https://docs.docker.com/engine/extend/legacy_plugins","https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://nvd.nist.gov/vuln/detail/CVE-2026-33997","https://github.com/advisories/GHSA-pxq6-2prw-chj9"],"source_kind":"github","identifiers":["GHSA-pxq6-2prw-chj9","CVE-2026-33997"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-27T18:00:09.113Z","updated_at":"2026-10-16T06:04:37.861Z","epss_percentage":0.00512,"epss_percentile":0.41516,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1weHE2LTJwcnctY2hqOc4ABUYa","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1weHE2LTJwcnctY2hqOc4ABUYa","packages":[{"ecosystem":"go","package_name":"github.com/moby/moby/v2","versions":[{"first_patched_version":"2.0.0-beta.8","vulnerable_version_range":"\u003c 2.0.0-beta.8"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby%2Fv2"},{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c 29.3.1"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"},{"ecosystem":"go","package_name":"github.com/docker/docker","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c 29.3.1"}],"purl":"pkg:go/github.com%2Fdocker%2Fdocker"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1weHE2LTJwcnctY2hqOc4ABUYa/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xNTlqLXZ2NGotdjMzY84ABB7m","url":"https://github.com/advisories/GHSA-q59j-vv4j-v33c","title":"NULL Pointer Dereference on moby image history","description":"moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-11-29T18:34:03.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","references":["https://nvd.nist.gov/vuln/detail/CVE-2024-36620","https://github.com/moby/moby/commit/ab570ab3d62038b3d26f96a9bb585d0b6095b9b4","https://gist.github.com/1047524396/f08816669701ab478a265a811d2c89b2","https://github.com/moby/moby/blob/v26.0.2/daemon/images/image_history.go#L48","https://pkg.go.dev/vuln/GO-2024-3311","https://github.com/advisories/GHSA-q59j-vv4j-v33c"],"source_kind":"github","identifiers":["GHSA-q59j-vv4j-v33c","CVE-2024-36620"],"repository_url":"https://github.com/moby/moby","blast_radius":18.35013829799022,"created_at":"2024-12-04T23:08:24.696Z","updated_at":"2026-10-03T14:07:20.027Z","epss_percentage":0.00819,"epss_percentile":0.55513,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xNTlqLXZ2NGotdjMzY84ABB7m","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xNTlqLXZ2NGotdjMzY84ABB7m","packages":[{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":"26.1.0","vulnerable_version_range":"\u003e= 25.0.0, \u003c 26.1.0"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xNTlqLXZ2NGotdjMzY84ABB7m/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1naDVjLTNoOTctMmYzcc4ABB7x","url":"https://github.com/advisories/GHSA-gh5c-3h97-2f3q","title":"Moby Race Condition vulnerability","description":"moby v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-11-29T18:34:03.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2024-36623","https://github.com/moby/moby/commit/5689dabfb357b673abdb4391eef426f297d7d1bb","https://gist.github.com/1047524396/c192c0159a19bf58a4373b696467dc29","https://github.com/moby/moby/blob/v25.0.3/pkg/streamformatter/streamformatter.go#L115","https://github.com/moby/moby/commit/8e3bcf19748838b30e34d612832d1dc9d90363b8","https://github.com/advisories/GHSA-gh5c-3h97-2f3q"],"source_kind":"github","identifiers":["GHSA-gh5c-3h97-2f3q","CVE-2024-36623"],"repository_url":"https://github.com/moby/moby","blast_radius":28.00810582324823,"created_at":"2024-12-02T22:07:14.161Z","updated_at":"2026-10-16T06:07:34.144Z","epss_percentage":0.00642,"epss_percentile":0.49589,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1naDVjLTNoOTctMmYzcc4ABB7x","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1naDVjLTNoOTctMmYzcc4ABB7x","packages":[{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":"25.0.4","vulnerable_version_range":"\u003c 25.0.4"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1naDVjLTNoOTctMmYzcc4ABB7x/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0ybWozLXZmdngtZmM0M84ABB7w","url":"https://github.com/advisories/GHSA-2mj3-vfvx-fc43","title":"Moby Race Condition vulnerability","description":"moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-11-29T18:34:03.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2024-36621","https://github.com/moby/moby/commit/37545cc644344dcb576cba67eb7b6f51a463d31e","https://gist.github.com/1047524396/5d44459edab5fafcdf86b43909b81135","https://github.com/moby/moby/blob/v25.0.5/builder/builder-next/adapters/snapshot/layer.go#L24","https://github.com/advisories/GHSA-2mj3-vfvx-fc43"],"source_kind":"github","identifiers":["GHSA-2mj3-vfvx-fc43","CVE-2024-36621"],"repository_url":"https://github.com/moby/moby","blast_radius":28.00810582324823,"created_at":"2024-12-02T22:07:14.192Z","updated_at":"2026-10-12T12:12:24.265Z","epss_percentage":0.00626,"epss_percentile":0.48529,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ybWozLXZmdngtZmM0M84ABB7w","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0ybWozLXZmdngtZmM0M84ABB7w","packages":[{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":"26.0.0","vulnerable_version_range":"\u003c 26.0.0"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ybWozLXZmdngtZmM0M84ABB7w/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14bW14LTdqcGYtZng0Ms4AA84W","url":"https://github.com/advisories/GHSA-xmmx-7jpf-fx42","title":"Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing","description":"### Impact\nIn the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header.  Versions of Moby (Docker Engine) prior to 20.10.11 treat the Content-Type header as trusted and deserialize the document according to that header.  If the Content-Type header changed between pulls of the same ambiguous document (with the same digest), the document may be interpreted differently, meaning that the digest alone is insufficient to unambiguously identify the content of the image.\n\n### Patches\nThis issue has been fixed in Moby (Docker Engine) 20.10.11.  Image pulls for manifests that contain a “manifests” field or indices which contain a “layers” field are rejected.\n\n### Workarounds\nEnsure you only pull images from trusted sources.\n\n### References\nhttps://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m\nhttps://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh\n\n### For more information\nIf you have any questions or comments about this advisory:\n* [Open an issue in](https://github.com/moby/moby/issues/new)\n* Email us at [security@docker.com](mailto:security@docker.com)\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-06-10T18:39:03.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://github.com/moby/moby/security/advisories/GHSA-xmmx-7jpf-fx42","https://github.com/advisories/GHSA-xmmx-7jpf-fx42"],"source_kind":"github","identifiers":["GHSA-xmmx-7jpf-fx42"],"repository_url":"https://github.com/moby/moby","blast_radius":0.0,"created_at":"2024-06-10T19:05:21.505Z","updated_at":"2026-10-17T05:17:05.901Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14bW14LTdqcGYtZng0Ms4AA84W","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14bW14LTdqcGYtZng0Ms4AA84W","packages":[{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":"20.10.11","vulnerable_version_range":"\u003c 20.10.11"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"},{"ecosystem":"go","package_name":"github.com/docker/docker","versions":[{"first_patched_version":"20.10.11","vulnerable_version_range":"\u003c 20.10.11"}],"purl":"pkg:go/github.com%2Fdocker%2Fdocker"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14bW14LTdqcGYtZng0Ms4AA84W/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0ybW03LXg1aDYtNXB2cc4AA7PS","url":"https://github.com/advisories/GHSA-2mm7-x5h6-5pvq","title":"Moby (Docker Engine) started with non-empty inheritable Linux process capabilities","description":"### Impact\n\nA bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`.  Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set.  Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set.  Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted.\n\nThis bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set.\n\n\n### Patches\n\nThis bug has been fixed in Moby (Docker Engine) 20.10.14.  Users should update to this version as soon as possible.  Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset.\n\nThis fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment.  Refer to `capabilities(7)` for a description of how capabilities work.  Note that permitted file capabilities continue to allow for privileges to be raised up to the container's bounding set and that processes may add capabilities to their own inheritable set up to the container's bounding set per the rules described in the manual page.  In all cases the container's bounding set provides an upper bound on the capabilities that can be assumed and provides for the container security sandbox.\n\n### Workarounds\n\nThe entrypoint of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting.\n\n### Credits\n\nThe Moby project would like to thank [Andrew G. Morgan](https://github.com/AndrewGMorgan) for responsibly disclosing this issue in accordance with the [Moby security policy](https://github.com/moby/moby/blob/master/SECURITY.md).\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Open an issue](https://github.com/moby/moby/issues/new)\n* Email us at [security@docker.com](mailto:security@docker.com) if you think you’ve found a security bug","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-04-22T18:45:21.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","references":["https://github.com/moby/moby/security/advisories/GHSA-2mm7-x5h6-5pvq","https://nvd.nist.gov/vuln/detail/CVE-2022-24769","https://github.com/moby/moby/commit/2bbc786e4c59761d722d2d1518cd0a32829bc07f","https://github.com/moby/moby/commit/7f375bcff41ce672cd61e9a31f3eeb2966e3dbe1","https://www.debian.org/security/2022/dsa-5162","https://security.gentoo.org/glsa/202401-31","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQCVS7WBFSTKJFNX5PGDRARMTOFWV2O7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HIMAHZ6AUIKN7AX26KHZYBXVECIOVWBH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPOJUJZXGMIVKRS4QR75F6OIXNQ6LDBL","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5FQJ3MLFSEKQYCFPFZIKYGBXPZUJFVY","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5AFKOQ5CE3CEIULWW4FLQKHFFU6FSYG","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PMQKCAPK2AR3DCYITJYMMNBEGQBGLCC","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQCVS7WBFSTKJFNX5PGDRARMTOFWV2O7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIMAHZ6AUIKN7AX26KHZYBXVECIOVWBH","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPOJUJZXGMIVKRS4QR75F6OIXNQ6LDBL","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5FQJ3MLFSEKQYCFPFZIKYGBXPZUJFVY","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5AFKOQ5CE3CEIULWW4FLQKHFFU6FSYG","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PMQKCAPK2AR3DCYITJYMMNBEGQBGLCC","https://github.com/moby/moby/releases/tag/v20.10.14","http://www.openwall.com/lists/oss-security/2022/05/12/1","https://github.com/advisories/GHSA-2mm7-x5h6-5pvq"],"source_kind":"github","identifiers":["GHSA-2mm7-x5h6-5pvq","CVE-2022-24769"],"repository_url":"https://github.com/moby/moby","blast_radius":0.0,"created_at":"2024-04-22T19:04:54.410Z","updated_at":"2026-10-14T10:12:45.224Z","epss_percentage":0.00492,"epss_percentile":0.40544,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ybW03LXg1aDYtNXB2cc4AA7PS","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0ybW03LXg1aDYtNXB2cc4AA7PS","packages":[{"ecosystem":"go","package_name":"github.com/docker/docker","versions":[{"first_patched_version":"20.10.14","vulnerable_version_range":"\u003c 20.10.14"}],"purl":"pkg:go/github.com%2Fdocker%2Fdocker"},{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":"20.10.14","vulnerable_version_range":"\u003c 20.10.14"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ybW03LXg1aDYtNXB2cc4AA7PS/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14dzczLXJ3MzgtNnZqY84AA4_x","url":"https://github.com/advisories/GHSA-xw73-rw38-6vjc","title":"Classic builder cache poisoning","description":"The classic builder cache system is prone to cache poisoning if the image is built `FROM scratch`.\nAlso, changes to some instructions (most important being `HEALTHCHECK` and `ONBUILD`) would not cause a cache miss.\n\n\nAn attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps.\n\nFor example, an attacker could create an image that is considered as a valid cache candidate for:\n```\nFROM scratch\nMAINTAINER Pawel\n```\n\nwhen in fact the malicious image used as a cache would be an image built from a different Dockerfile.\n\nIn the second case, the attacker could for example substitute a different `HEALTCHECK` command.\n\n\n### Impact\n\n23.0+ users are only affected if they explicitly opted out of Buildkit (`DOCKER_BUILDKIT=0` environment variable) or are using the `/build` API endpoint (which uses the classic builder by default).\n\nAll users on versions older than 23.0 could be impacted. An example could be a CI with a shared cache, or just a regular Docker user pulling a malicious image due to misspelling/typosquatting.\n\nImage build API endpoint (`/build`) and `ImageBuild` function from `github.com/docker/docker/client` is also affected as it the uses classic builder by default. \n\n\n### Patches\n\nPatches are included in Moby releases:\n\n- v25.0.2\n- v24.0.9\n- v23.0.10\n\n### Workarounds\n\n- Use `--no-cache` or use Buildkit if possible (`DOCKER_BUILDKIT=1`, it's default on 23.0+ assuming that the buildx plugin is installed).\n- Use `Version = types.BuilderBuildKit` or `NoCache = true` in `ImageBuildOptions` for `ImageBuild` call.\n\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-02-01T20:51:19.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.9,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","references":["https://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc","https://nvd.nist.gov/vuln/detail/CVE-2024-24557","https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae","https://github.com/moby/moby/commit/fca702de7f71362c8d103073c7e4a1d0a467fadd","https://github.com/moby/moby/commit/fce6e0ca9bc000888de3daa157af14fa41fcd0ff","https://github.com/advisories/GHSA-xw73-rw38-6vjc"],"source_kind":"github","identifiers":["GHSA-xw73-rw38-6vjc","CVE-2024-24557"],"repository_url":"https://github.com/moby/moby","blast_radius":0.0,"created_at":"2024-02-01T21:05:06.115Z","updated_at":"2026-10-17T05:19:48.598Z","epss_percentage":0.0026,"epss_percentile":0.16526,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14dzczLXJ3MzgtNnZqY84AA4_x","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14dzczLXJ3MzgtNnZqY84AA4_x","packages":[{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":"25.0.2","vulnerable_version_range":"\u003e= 25.0.0, \u003c 25.0.2"},{"first_patched_version":"24.0.9","vulnerable_version_range":"\u003c 24.0.9"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"},{"ecosystem":"go","package_name":"github.com/docker/docker","versions":[{"first_patched_version":"24.0.9","vulnerable_version_range":"\u003c 24.0.9"},{"first_patched_version":"25.0.2","vulnerable_version_range":"\u003e= 25.0.0, \u003c 25.0.2"}],"purl":"pkg:go/github.com%2Fdocker%2Fdocker"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14dzczLXJ3MzgtNnZqY84AA4_x/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zZnd4LXBqZ3ctMzU1OM4AA4-5","url":"https://github.com/advisories/GHSA-3fwx-pjgw-3558","title":"Moby (Docker Engine) Insufficiently restricted permissions on data directory","description":"## Impact\n\nA bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs.  When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs.  When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files.\n\n## Patches\n\nThis bug has been fixed in Moby (Docker Engine) 20.10.9.  Users should update to this version as soon as possible.  Running containers should be stopped and restarted for the permissions to be fixed.\n\n## Workarounds\n\nLimit access to the host to trusted users.  Limit access to host volumes to trusted containers.\n\n## Credits\n\nThe Moby project would like to thank Joan Bruguera for responsibly disclosing this issue in accordance with the [Moby security policy](https://github.com/moby/moby/blob/master/SECURITY.md).\n\n## For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Open an issue](https://github.com/moby/moby/issues/new)\n* Email us at security@docker.com if you think you’ve found a security bug","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-01-31T23:28:58.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","references":["https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558","https://nvd.nist.gov/vuln/detail/CVE-2021-41091","https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64","https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB","https://github.com/advisories/GHSA-3fwx-pjgw-3558"],"source_kind":"github","identifiers":["GHSA-3fwx-pjgw-3558","CVE-2021-41091"],"repository_url":"https://github.com/moby/moby","blast_radius":0.0,"created_at":"2024-02-01T00:05:34.074Z","updated_at":"2026-10-17T05:21:08.039Z","epss_percentage":0.02848,"epss_percentile":0.85507,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zZnd4LXBqZ3ctMzU1OM4AA4-5","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zZnd4LXBqZ3ctMzU1OM4AA4-5","packages":[{"ecosystem":"go","package_name":"github.com/docker/docker","versions":[{"first_patched_version":"20.10.9","vulnerable_version_range":"\u003c 20.10.9"}],"purl":"pkg:go/github.com%2Fdocker%2Fdocker"},{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":"20.10.9","vulnerable_version_range":"\u003c 20.10.9"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zZnd4LXBqZ3ctMzU1OM4AA4-5/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02Zmo1LW04MjItcnF4OM4AA4-0","url":"https://github.com/advisories/GHSA-6fj5-m822-rqx8","title":"moby docker daemon crash during image pull of malicious image","description":"### Impact\n\nPulling an intentionally malformed Docker image manifest crashes the `dockerd` daemon.\n\n### Patches\n\nVersions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.\n\n### Credits\n\nMaintainers would like to thank Josh Larsen, Ian Coldwater, Duffie Cooley, Rory McCune for working on the vulnerability and Brad Geesaman for responsibly disclosing it to security@docker.com.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-01-31T23:16:46.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","references":["https://github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8","https://nvd.nist.gov/vuln/detail/CVE-2021-21285","https://github.com/moby/moby/commit/8d3179546e79065adefa67cc697c09d0ab137d30","https://docs.docker.com/engine/release-notes/#20103","https://github.com/moby/moby/releases/tag/v19.03.15","https://github.com/moby/moby/releases/tag/v20.10.3","https://security.gentoo.org/glsa/202107-23","https://www.debian.org/security/2021/dsa-4865","https://security.netapp.com/advisory/ntap-20210226-0005","https://github.com/advisories/GHSA-6fj5-m822-rqx8"],"source_kind":"github","identifiers":["GHSA-6fj5-m822-rqx8","CVE-2021-21285"],"repository_url":"https://github.com/moby/moby","blast_radius":0.0,"created_at":"2024-02-01T00:05:34.241Z","updated_at":"2026-10-03T14:10:09.127Z","epss_percentage":0.03287,"epss_percentile":0.87502,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02Zmo1LW04MjItcnF4OM4AA4-0","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02Zmo1LW04MjItcnF4OM4AA4-0","packages":[{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":"20.10.3","vulnerable_version_range":"\u003e= 20.10.0-beta1, \u003c 20.10.3"},{"first_patched_version":"19.3.15","vulnerable_version_range":"\u003c 19.3.15"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02Zmo1LW04MjItcnF4OM4AA4-0/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03NDUyLXhxcGotNnJwY84AA4-z","url":"https://github.com/advisories/GHSA-7452-xqpj-6rpc","title":"moby Access to remapped root allows privilege escalation to real root","description":"### Impact\n\nWhen using `--userns-remap`, if the root user in the remapped namespace has access to the host filesystem they can modify files under `/var/lib/docker/\u003cremapping\u003e` that cause writing files with extended privileges.\n\n### Patches\n\nVersions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.\n\n### Credits\n\nMaintainers would like to thank Alex Chapman for discovering the vulnerability; @awprice, @nathanburrell, @raulgomis, @chris-walz, @erin-jensby, @bassmatt, @mark-adams, @dbaxa for working on it and Zac Ellis for responsibly disclosing it to security@docker.com","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-01-31T23:14:25.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.8,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","references":["https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc","https://nvd.nist.gov/vuln/detail/CVE-2021-21284","https://github.com/moby/moby/commit/64bd4485b3a66a597c02c95f5776395e540b2c7c","https://docs.docker.com/engine/release-notes/#20103","https://github.com/moby/moby/releases/tag/v19.03.15","https://github.com/moby/moby/releases/tag/v20.10.3","https://security.gentoo.org/glsa/202107-23","https://www.debian.org/security/2021/dsa-4865","https://security.netapp.com/advisory/ntap-20210226-0005","https://github.com/advisories/GHSA-7452-xqpj-6rpc"],"source_kind":"github","identifiers":["GHSA-7452-xqpj-6rpc","CVE-2021-21284"],"repository_url":"https://github.com/moby/moby","blast_radius":0.0,"created_at":"2024-02-01T00:05:34.280Z","updated_at":"2026-10-16T20:16:11.818Z","epss_percentage":0.01065,"epss_percentile":0.63501,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03NDUyLXhxcGotNnJwY84AA4-z","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03NDUyLXhxcGotNnJwY84AA4-z","packages":[{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":"20.10.3","vulnerable_version_range":"\u003e= 20.10.0-beta1, \u003c 20.10.3"},{"first_patched_version":"19.3.15","vulnerable_version_range":"\u003c 19.3.15"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03NDUyLXhxcGotNnJwY84AA4-z/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02aHdnLXc1amctOWM2eM4AA4-y","url":"https://github.com/advisories/GHSA-6hwg-w5jg-9c6x","title":"Path Traversal in Moby builder","description":"util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-01-31T23:13:10.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2020-27534","https://github.com/moby/buildkit/pull/1462","https://github.com/moby/moby/pull/40877","https://bugzilla.redhat.com/show_bug.cgi?id=1921154","http://web.archive.org/web/20200530054359/https://docs.docker.com/engine/release-notes","https://github.com/advisories/GHSA-6hwg-w5jg-9c6x"],"source_kind":"github","identifiers":["GHSA-6hwg-w5jg-9c6x","CVE-2020-27534"],"repository_url":"https://github.com/moby/buildkit","blast_radius":0.0,"created_at":"2024-02-01T00:05:34.391Z","updated_at":"2026-10-17T05:21:08.046Z","epss_percentage":0.01766,"epss_percentile":0.77506,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02aHdnLXc1amctOWM2eM4AA4-y","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02aHdnLXc1amctOWM2eM4AA4-y","packages":[{"ecosystem":"go","package_name":"github.com/docker/docker","versions":[{"first_patched_version":"19.03.9","vulnerable_version_range":"\u003c 19.03.9"}],"purl":"pkg:go/github.com%2Fdocker%2Fdocker"},{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":"19.03.9","vulnerable_version_range":"\u003c 19.03.9"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02aHdnLXc1amctOWM2eM4AA4-y/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12ZmpjLTJxY3ctajk1as4AAYJq","url":"https://github.com/advisories/GHSA-vfjc-2qcw-j95j","title":"Docker Moby /proc/scsi Path Exposure Allows Host Data Loss (SCSI MICDROP)","description":"The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a \"scsi remove-single-device\" line to /proc/scsi/scsi, aka SCSI MICDROP.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-05-17T00:21:35.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2017-16539","https://github.com/moby/moby/pull/35399","https://marc.info/?l=linux-scsi\u0026m=150985062200941\u0026w=2","https://marc.info/?l=linux-scsi\u0026m=150985455801444\u0026w=2","https://twitter.com/ewindisch/status/926443521820774401","https://github.com/moby/moby/commit/a21ecdf3c8a343a7c94e4c4d01b178c87ca7aaa1","https://github.com/advisories/GHSA-vfjc-2qcw-j95j"],"source_kind":"github","identifiers":["GHSA-vfjc-2qcw-j95j","CVE-2017-16539"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-01-29T16:00:07.779Z","updated_at":"2026-10-02T15:05:52.654Z","epss_percentage":0.01829,"epss_percentile":0.77916,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12ZmpjLTJxY3ctajk1as4AAYJq","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12ZmpjLTJxY3ctajk1as4AAYJq","packages":[{"ecosystem":"go","package_name":"github.com/moby/moby","versions":[{"first_patched_version":"17.12.0-ce","vulnerable_version_range":"\u003c 17.12.0-ce"}],"purl":"pkg:go/github.com%2Fmoby%2Fmoby"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12ZmpjLTJxY3ctajk1as4AAYJq/related_packages","related_advisories":[]}]