csaf_opensuse - opensuse-su-2025:15589-1

opensuse-su-2025:15589-1

Vulnerability from csaf_opensuse

Published

2025-09-30 00:00

Modified

2025-09-30 00:00

Summary

docker-stable-24.0.9_ce-15.1 on GA media

Notes

Title of the patch

docker-stable-24.0.9_ce-15.1 on GA media

Description of the patch

These are all security issues fixed in the docker-stable-24.0.9_ce-15.1 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2025-15589

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "docker-stable-24.0.9_ce-15.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the docker-stable-24.0.9_ce-15.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-15589",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15589-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-3499 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-3499/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-5277 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-5277/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-6407 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-6407/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-6408 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-6408/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-8178 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-8178/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-8179 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-8179/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-9356 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-9356/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-9357 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-9357/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-9358 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-9358/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-3627 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-3627/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-3629 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-3629/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-3630 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-3630/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-3631 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-3631/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-3697 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-3697/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-8867 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-8867/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-9962 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-9962/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-14992 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-14992/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-16539 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-16539/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-10892 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-10892/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-15664 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-15664/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-16873 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-16873/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-16874 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-16874/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-16875 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-16875/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-20699 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-20699/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-13509 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-13509/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-14271 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-14271/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-12912 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-12912/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-13401 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-13401/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-15257 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-15257/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8694 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8694/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8695 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8695/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-21284 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-21284/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-41089 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-41089/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-41092 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-41092/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-41190 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-41190/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-43565 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-43565/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-24769 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-24769/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-36109 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-36109/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-28840 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-28840/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-28841 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-28841/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-28842 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-28842/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-23651 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-23651/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-23652 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-23652/"
      }
    ],
    "title": "docker-stable-24.0.9_ce-15.1 on GA media",
    "tracking": {
      "current_release_date": "2025-09-30T00:00:00Z",
      "generator": {
        "date": "2025-09-30T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:15589-1",
      "initial_release_date": "2025-09-30T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-09-30T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "docker-stable-24.0.9_ce-15.1.aarch64",
                "product": {
                  "name": "docker-stable-24.0.9_ce-15.1.aarch64",
                  "product_id": "docker-stable-24.0.9_ce-15.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
                "product": {
                  "name": "docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
                  "product_id": "docker-stable-bash-completion-24.0.9_ce-15.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-buildx-0.25.0-15.1.aarch64",
                "product": {
                  "name": "docker-stable-buildx-0.25.0-15.1.aarch64",
                  "product_id": "docker-stable-buildx-0.25.0-15.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
                "product": {
                  "name": "docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
                  "product_id": "docker-stable-fish-completion-24.0.9_ce-15.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
                "product": {
                  "name": "docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
                  "product_id": "docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
                "product": {
                  "name": "docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
                  "product_id": "docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "docker-stable-24.0.9_ce-15.1.ppc64le",
                "product": {
                  "name": "docker-stable-24.0.9_ce-15.1.ppc64le",
                  "product_id": "docker-stable-24.0.9_ce-15.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
                "product": {
                  "name": "docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
                  "product_id": "docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-buildx-0.25.0-15.1.ppc64le",
                "product": {
                  "name": "docker-stable-buildx-0.25.0-15.1.ppc64le",
                  "product_id": "docker-stable-buildx-0.25.0-15.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
                "product": {
                  "name": "docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
                  "product_id": "docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
                "product": {
                  "name": "docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
                  "product_id": "docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
                "product": {
                  "name": "docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
                  "product_id": "docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "docker-stable-24.0.9_ce-15.1.s390x",
                "product": {
                  "name": "docker-stable-24.0.9_ce-15.1.s390x",
                  "product_id": "docker-stable-24.0.9_ce-15.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
                "product": {
                  "name": "docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
                  "product_id": "docker-stable-bash-completion-24.0.9_ce-15.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-buildx-0.25.0-15.1.s390x",
                "product": {
                  "name": "docker-stable-buildx-0.25.0-15.1.s390x",
                  "product_id": "docker-stable-buildx-0.25.0-15.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
                "product": {
                  "name": "docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
                  "product_id": "docker-stable-fish-completion-24.0.9_ce-15.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
                "product": {
                  "name": "docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
                  "product_id": "docker-stable-rootless-extras-24.0.9_ce-15.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
                "product": {
                  "name": "docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
                  "product_id": "docker-stable-zsh-completion-24.0.9_ce-15.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "docker-stable-24.0.9_ce-15.1.x86_64",
                "product": {
                  "name": "docker-stable-24.0.9_ce-15.1.x86_64",
                  "product_id": "docker-stable-24.0.9_ce-15.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
                "product": {
                  "name": "docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
                  "product_id": "docker-stable-bash-completion-24.0.9_ce-15.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-buildx-0.25.0-15.1.x86_64",
                "product": {
                  "name": "docker-stable-buildx-0.25.0-15.1.x86_64",
                  "product_id": "docker-stable-buildx-0.25.0-15.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
                "product": {
                  "name": "docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
                  "product_id": "docker-stable-fish-completion-24.0.9_ce-15.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
                "product": {
                  "name": "docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
                  "product_id": "docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64",
                "product": {
                  "name": "docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64",
                  "product_id": "docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-24.0.9_ce-15.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64"
        },
        "product_reference": "docker-stable-24.0.9_ce-15.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-24.0.9_ce-15.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le"
        },
        "product_reference": "docker-stable-24.0.9_ce-15.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-24.0.9_ce-15.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x"
        },
        "product_reference": "docker-stable-24.0.9_ce-15.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-24.0.9_ce-15.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64"
        },
        "product_reference": "docker-stable-24.0.9_ce-15.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-bash-completion-24.0.9_ce-15.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64"
        },
        "product_reference": "docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le"
        },
        "product_reference": "docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-bash-completion-24.0.9_ce-15.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x"
        },
        "product_reference": "docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-bash-completion-24.0.9_ce-15.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64"
        },
        "product_reference": "docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-buildx-0.25.0-15.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64"
        },
        "product_reference": "docker-stable-buildx-0.25.0-15.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-buildx-0.25.0-15.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le"
        },
        "product_reference": "docker-stable-buildx-0.25.0-15.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-buildx-0.25.0-15.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x"
        },
        "product_reference": "docker-stable-buildx-0.25.0-15.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-buildx-0.25.0-15.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64"
        },
        "product_reference": "docker-stable-buildx-0.25.0-15.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-fish-completion-24.0.9_ce-15.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64"
        },
        "product_reference": "docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le"
        },
        "product_reference": "docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-fish-completion-24.0.9_ce-15.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x"
        },
        "product_reference": "docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-fish-completion-24.0.9_ce-15.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64"
        },
        "product_reference": "docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64"
        },
        "product_reference": "docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le"
        },
        "product_reference": "docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-rootless-extras-24.0.9_ce-15.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x"
        },
        "product_reference": "docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64"
        },
        "product_reference": "docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64"
        },
        "product_reference": "docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le"
        },
        "product_reference": "docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-zsh-completion-24.0.9_ce-15.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x"
        },
        "product_reference": "docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        },
        "product_reference": "docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-3499",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-3499"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-3499",
          "url": "https://www.suse.com/security/cve/CVE-2014-3499"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 885209 for CVE-2014-3499",
          "url": "https://bugzilla.suse.com/885209"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-3499"
    },
    {
      "cve": "CVE-2014-5277",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-5277"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-5277",
          "url": "https://www.suse.com/security/cve/CVE-2014-5277"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 904165 for CVE-2014-5277",
          "url": "https://bugzilla.suse.com/904165"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-5277"
    },
    {
      "cve": "CVE-2014-6407",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-6407"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-6407",
          "url": "https://www.suse.com/security/cve/CVE-2014-6407"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 907012 for CVE-2014-6407",
          "url": "https://bugzilla.suse.com/907012"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-6407"
    },
    {
      "cve": "CVE-2014-6408",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-6408"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-6408",
          "url": "https://www.suse.com/security/cve/CVE-2014-6408"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 907014 for CVE-2014-6408",
          "url": "https://bugzilla.suse.com/907014"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-6408"
    },
    {
      "cve": "CVE-2014-8178",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-8178"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-8178",
          "url": "https://www.suse.com/security/cve/CVE-2014-8178"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 949660 for CVE-2014-8178",
          "url": "https://bugzilla.suse.com/949660"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2014-8178"
    },
    {
      "cve": "CVE-2014-8179",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-8179"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-8179",
          "url": "https://www.suse.com/security/cve/CVE-2014-8179"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 949660 for CVE-2014-8179",
          "url": "https://bugzilla.suse.com/949660"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2014-8179"
    },
    {
      "cve": "CVE-2014-9356",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-9356"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-9356",
          "url": "https://www.suse.com/security/cve/CVE-2014-9356"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 909710 for CVE-2014-9356",
          "url": "https://bugzilla.suse.com/909710"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 909712 for CVE-2014-9356",
          "url": "https://bugzilla.suse.com/909712"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 909747 for CVE-2014-9356",
          "url": "https://bugzilla.suse.com/909747"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2014-9356"
    },
    {
      "cve": "CVE-2014-9357",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-9357"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-9357",
          "url": "https://www.suse.com/security/cve/CVE-2014-9357"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 909710 for CVE-2014-9357",
          "url": "https://bugzilla.suse.com/909710"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 909747 for CVE-2014-9357",
          "url": "https://bugzilla.suse.com/909747"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2014-9357"
    },
    {
      "cve": "CVE-2014-9358",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-9358"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) \"docker load\" operation or (2) \"registry communications.\"",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-9358",
          "url": "https://www.suse.com/security/cve/CVE-2014-9358"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 909709 for CVE-2014-9358",
          "url": "https://bugzilla.suse.com/909709"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 909747 for CVE-2014-9358",
          "url": "https://bugzilla.suse.com/909747"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-9358"
    },
    {
      "cve": "CVE-2015-3627",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-3627"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-3627",
          "url": "https://www.suse.com/security/cve/CVE-2015-3627"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 930235 for CVE-2015-3627",
          "url": "https://bugzilla.suse.com/930235"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 945060 for CVE-2015-3627",
          "url": "https://bugzilla.suse.com/945060"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2015-3627"
    },
    {
      "cve": "CVE-2015-3629",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-3629"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization (\"mount namespace breakout\") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-3629",
          "url": "https://www.suse.com/security/cve/CVE-2015-3629"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 930235 for CVE-2015-3629",
          "url": "https://bugzilla.suse.com/930235"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 945060 for CVE-2015-3629",
          "url": "https://bugzilla.suse.com/945060"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2015-3629"
    },
    {
      "cve": "CVE-2015-3630",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-3630"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-3630",
          "url": "https://www.suse.com/security/cve/CVE-2015-3630"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 930235 for CVE-2015-3630",
          "url": "https://bugzilla.suse.com/930235"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 945060 for CVE-2015-3630",
          "url": "https://bugzilla.suse.com/945060"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2015-3630"
    },
    {
      "cve": "CVE-2015-3631",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-3631"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-3631",
          "url": "https://www.suse.com/security/cve/CVE-2015-3631"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 930235 for CVE-2015-3631",
          "url": "https://bugzilla.suse.com/930235"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 945060 for CVE-2015-3631",
          "url": "https://bugzilla.suse.com/945060"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-3631"
    },
    {
      "cve": "CVE-2016-3697",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-3697"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-3697",
          "url": "https://www.suse.com/security/cve/CVE-2016-3697"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 976777 for CVE-2016-3697",
          "url": "https://bugzilla.suse.com/976777"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-3697"
    },
    {
      "cve": "CVE-2016-8867",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-8867"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-8867",
          "url": "https://www.suse.com/security/cve/CVE-2016-8867"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1007249 for CVE-2016-8867",
          "url": "https://bugzilla.suse.com/1007249"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-8867"
    },
    {
      "cve": "CVE-2016-9962",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-9962"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "RunC allowed additional container processes via \u0027runc exec\u0027 to be ptraced by the pid 1 of the container.  This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-9962",
          "url": "https://www.suse.com/security/cve/CVE-2016-9962"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1012568 for CVE-2016-9962",
          "url": "https://bugzilla.suse.com/1012568"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1173425 for CVE-2016-9962",
          "url": "https://bugzilla.suse.com/1173425"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-9962"
    },
    {
      "cve": "CVE-2017-14992",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-14992"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-14992",
          "url": "https://www.suse.com/security/cve/CVE-2017-14992"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1066210 for CVE-2017-14992",
          "url": "https://bugzilla.suse.com/1066210"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-14992"
    },
    {
      "cve": "CVE-2017-16539",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-16539"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a \"scsi remove-single-device\" line to /proc/scsi/scsi, aka SCSI MICDROP.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-16539",
          "url": "https://www.suse.com/security/cve/CVE-2017-16539"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1066801 for CVE-2017-16539",
          "url": "https://bugzilla.suse.com/1066801"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-16539"
    },
    {
      "cve": "CVE-2018-10892",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-10892"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host\u0027s hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-10892",
          "url": "https://www.suse.com/security/cve/CVE-2018-10892"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1100331 for CVE-2018-10892",
          "url": "https://bugzilla.suse.com/1100331"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1100838 for CVE-2018-10892",
          "url": "https://bugzilla.suse.com/1100838"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-10892"
    },
    {
      "cve": "CVE-2018-15664",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-15664"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Docker through 18.06.1-ce-rc2, the API endpoints behind the \u0027docker cp\u0027 command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-15664",
          "url": "https://www.suse.com/security/cve/CVE-2018-15664"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1096726 for CVE-2018-15664",
          "url": "https://bugzilla.suse.com/1096726"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1139649 for CVE-2018-15664",
          "url": "https://bugzilla.suse.com/1139649"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-15664"
    },
    {
      "cve": "CVE-2018-16873",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-16873"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it\u0027s possible to arrange things so that a Git repository is cloned to a folder named \".git\" by using a vanity import path that ends with \"/.git\". If the Git repository root contains a \"HEAD\" file, a \"config\" file, an \"objects\" directory, a \"refs\" directory, with some work to ensure the proper ordering of operations, \"go get -u\" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the \"config\" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running \"go get -u\".",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-16873",
          "url": "https://www.suse.com/security/cve/CVE-2018-16873"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118897 for CVE-2018-16873",
          "url": "https://bugzilla.suse.com/1118897"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118898 for CVE-2018-16873",
          "url": "https://bugzilla.suse.com/1118898"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118899 for CVE-2018-16873",
          "url": "https://bugzilla.suse.com/1118899"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-16873"
    },
    {
      "cve": "CVE-2018-16874",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-16874"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both \u0027{\u0027 and \u0027}\u0027 characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-16874",
          "url": "https://www.suse.com/security/cve/CVE-2018-16874"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118897 for CVE-2018-16874",
          "url": "https://bugzilla.suse.com/1118897"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118898 for CVE-2018-16874",
          "url": "https://bugzilla.suse.com/1118898"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118899 for CVE-2018-16874",
          "url": "https://bugzilla.suse.com/1118899"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-16874"
    },
    {
      "cve": "CVE-2018-16875",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-16875"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-16875",
          "url": "https://www.suse.com/security/cve/CVE-2018-16875"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118897 for CVE-2018-16875",
          "url": "https://bugzilla.suse.com/1118897"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118898 for CVE-2018-16875",
          "url": "https://bugzilla.suse.com/1118898"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1118899 for CVE-2018-16875",
          "url": "https://bugzilla.suse.com/1118899"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-16875"
    },
    {
      "cve": "CVE-2018-20699",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-20699"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-20699",
          "url": "https://www.suse.com/security/cve/CVE-2018-20699"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1121768 for CVE-2018-20699",
          "url": "https://bugzilla.suse.com/1121768"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-20699"
    },
    {
      "cve": "CVE-2019-13509",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-13509"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-13509",
          "url": "https://www.suse.com/security/cve/CVE-2019-13509"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1142160 for CVE-2019-13509",
          "url": "https://bugzilla.suse.com/1142160"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-13509"
    },
    {
      "cve": "CVE-2019-14271",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-14271"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-14271",
          "url": "https://www.suse.com/security/cve/CVE-2019-14271"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1143409 for CVE-2019-14271",
          "url": "https://bugzilla.suse.com/1143409"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-14271"
    },
    {
      "cve": "CVE-2020-12912",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-12912"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A potential vulnerability in the AMD extension to Linux \"hwmon\" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-12912",
          "url": "https://www.suse.com/security/cve/CVE-2020-12912"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178760 for CVE-2020-12912",
          "url": "https://bugzilla.suse.com/1178760"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-12912"
    },
    {
      "cve": "CVE-2020-13401",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-13401"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-13401",
          "url": "https://www.suse.com/security/cve/CVE-2020-13401"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1172375 for CVE-2020-13401",
          "url": "https://bugzilla.suse.com/1172375"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1172377 for CVE-2020-13401",
          "url": "https://bugzilla.suse.com/1172377"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-13401"
    },
    {
      "cve": "CVE-2020-15257",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-15257"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim\u0027s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the \"host\" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container\u0027s privilege, regardless of what container runtime is used for running that container.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-15257",
          "url": "https://www.suse.com/security/cve/CVE-2020-15257"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178969 for CVE-2020-15257",
          "url": "https://bugzilla.suse.com/1178969"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-15257"
    },
    {
      "cve": "CVE-2020-8694",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8694"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8694",
          "url": "https://www.suse.com/security/cve/CVE-2020-8694"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1170415 for CVE-2020-8694",
          "url": "https://bugzilla.suse.com/1170415"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1170446 for CVE-2020-8694",
          "url": "https://bugzilla.suse.com/1170446"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178591 for CVE-2020-8694",
          "url": "https://bugzilla.suse.com/1178591"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178700 for CVE-2020-8694",
          "url": "https://bugzilla.suse.com/1178700"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179661 for CVE-2020-8694",
          "url": "https://bugzilla.suse.com/1179661"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-8694"
    },
    {
      "cve": "CVE-2020-8695",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8695"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8695",
          "url": "https://www.suse.com/security/cve/CVE-2020-8695"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1170415 for CVE-2020-8695",
          "url": "https://bugzilla.suse.com/1170415"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1170446 for CVE-2020-8695",
          "url": "https://bugzilla.suse.com/1170446"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178591 for CVE-2020-8695",
          "url": "https://bugzilla.suse.com/1178591"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-8695"
    },
    {
      "cve": "CVE-2021-21284",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-21284"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using \"--userns-remap\", if the root user in the remapped namespace has access to the host filesystem they can modify files under \"/var/lib/docker/\u003cremapping\u003e\" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-21284",
          "url": "https://www.suse.com/security/cve/CVE-2021-21284"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1181732 for CVE-2021-21284",
          "url": "https://bugzilla.suse.com/1181732"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2021-21284"
    },
    {
      "cve": "CVE-2021-41089",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-41089"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host\u0027s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-41089",
          "url": "https://www.suse.com/security/cve/CVE-2021-41089"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1191015 for CVE-2021-41089",
          "url": "https://bugzilla.suse.com/1191015"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1191355 for CVE-2021-41089",
          "url": "https://bugzilla.suse.com/1191355"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-41089"
    },
    {
      "cve": "CVE-2021-41092",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-41092"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-41092",
          "url": "https://www.suse.com/security/cve/CVE-2021-41092"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1191334 for CVE-2021-41092",
          "url": "https://bugzilla.suse.com/1191334"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1191355 for CVE-2021-41092",
          "url": "https://bugzilla.suse.com/1191355"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-41092"
    },
    {
      "cve": "CVE-2021-41190",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-41190"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both \"manifests\" and \"layers\" fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both \"manifests\" and \"layers\" fields or \"manifests\" and \"config\" fields if they are unable to update to version 1.0.1 of the spec.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-41190",
          "url": "https://www.suse.com/security/cve/CVE-2021-41190"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1193273 for CVE-2021-41190",
          "url": "https://bugzilla.suse.com/1193273"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-41190"
    },
    {
      "cve": "CVE-2021-43565",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-43565"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-43565",
          "url": "https://www.suse.com/security/cve/CVE-2021-43565"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1193930 for CVE-2021-43565",
          "url": "https://bugzilla.suse.com/1193930"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-43565"
    },
    {
      "cve": "CVE-2022-24769",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-24769"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container\u0027s bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container\u0027s bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a workaround, the entry point of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-24769",
          "url": "https://www.suse.com/security/cve/CVE-2022-24769"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1197517 for CVE-2022-24769",
          "url": "https://bugzilla.suse.com/1197517"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-24769"
    },
    {
      "cve": "CVE-2022-36109",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-36109"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.  This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `\"USER $USERNAME\"` Dockerfile instruction. Instead by calling `ENTRYPOINT [\"su\", \"-\", \"user\"]` the supplementary groups will be set up properly.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-36109",
          "url": "https://www.suse.com/security/cve/CVE-2022-36109"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1205375 for CVE-2022-36109",
          "url": "https://bugzilla.suse.com/1205375"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-36109"
    },
    {
      "cve": "CVE-2023-28840",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-28840"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly referred to as *Docker*.\n\nSwarm Mode, which is compiled in and delivered by default in dockerd and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code.\n\nThe overlay network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes.\n\nEncrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption.\n\nWhen setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the u32 iptables extension provided by the xt_u32 kernel module to directly filter on a VXLAN packet\u0027s VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN.\n\nTwo iptables rules serve to filter incoming VXLAN datagrams with a VNI that corresponds to an encrypted network and discards unencrypted datagrams. The rules are appended to the end of the INPUT filter chain, following any rules that have been previously set by the system administrator. Administrator-set rules take precedence over the rules Moby sets to discard unencrypted VXLAN datagrams, which can potentially admit unencrypted datagrams that should have been discarded.\n\nThe injection of arbitrary Ethernet frames can enable a Denial of Service attack. A sophisticated attacker may be able to establish a UDP or TCP connection by way of the container\u0027s outbound gateway that would otherwise be blocked by a stateful firewall, or carry out other escalations beyond simple injection by smuggling packets into the overlay network.\n\nPatches are available in Moby releases 23.0.3 and 20.10.24. As Mirantis Container Runtime\u0027s 20.10 releases are numbered differently, users of that platform should update to 20.10.16.\n\nSome workarounds are available. Close the VXLAN port (by default, UDP port 4789) to incoming traffic at the Internet boundary to prevent all VXLAN packet injection, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-28840",
          "url": "https://www.suse.com/security/cve/CVE-2023-28840"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1214107 for CVE-2023-28840",
          "url": "https://bugzilla.suse.com/1214107"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215525 for CVE-2023-28840",
          "url": "https://bugzilla.suse.com/1215525"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-28840"
    },
    {
      "cve": "CVE-2023-28841",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-28841"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*.\n\nSwarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code.\n\nThe `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes.\n\nEncrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption.\n\nWhen setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet\u0027s VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN.\n\nAn iptables rule designates outgoing VXLAN datagrams with a VNI that corresponds to an encrypted overlay network for IPsec encapsulation.\n\nEncrypted overlay networks on affected platforms silently transmit unencrypted data. As a result, `overlay` networks may appear to be functional, passing traffic as expected, but without any of the expected confidentiality or data integrity guarantees.\n\nIt is possible for an attacker sitting in a trusted position on the network to read all of the application traffic that is moving across the overlay network, resulting in unexpected secrets or user data disclosure. Thus, because many database protocols, internal APIs, etc. are not protected by a second layer of encryption, a user may use Swarm encrypted overlay networks to provide confidentiality, which due to this vulnerability this is no longer guaranteed.\n\nPatches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime\u0027s 20.10 releases are numbered differently, users of that platform should update to 20.10.16.\n\nSome workarounds are available. Close the VXLAN port (by default, UDP port 4789) to outgoing traffic at the Internet boundary in order to prevent unintentionally leaking unencrypted traffic over the Internet, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-28841",
          "url": "https://www.suse.com/security/cve/CVE-2023-28841"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1214108 for CVE-2023-28841",
          "url": "https://bugzilla.suse.com/1214108"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215525 for CVE-2023-28841",
          "url": "https://bugzilla.suse.com/1215525"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-28841"
    },
    {
      "cve": "CVE-2023-28842",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-28842"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*.\n\nSwarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code.\n\nThe `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes.\n\nEncrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption.\n\nWhen setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet\u0027s VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN.\n\nThe `overlay` driver dynamically and lazily defines the kernel configuration for the VXLAN network on each node as containers are attached and detached. Routes and encryption parameters are only defined for destination nodes that participate in the network. The iptables rules that prevent encrypted overlay networks from accepting unencrypted packets are not created until a peer is available with which to communicate.\n\nEncrypted overlay networks silently accept cleartext VXLAN datagrams that are tagged with the VNI of an encrypted overlay network. As a result, it is possible to inject arbitrary Ethernet frames into the encrypted overlay network by encapsulating them in VXLAN datagrams. The implications of this can be quite dire, and GHSA-vwm3-crmr-xfxw should be referenced for a deeper exploration.\n\nPatches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime\u0027s 20.10 releases are numbered differently, users of that platform should update to 20.10.16.\n\nSome workarounds are available. In multi-node clusters, deploy a global \u0027pause\u0027 container for each encrypted overlay network, on every node. For a single-node cluster, do not use overlay networks of any sort. Bridge networks provide the same connectivity on a single node and have no multi-node features. The Swarm ingress feature is implemented using an overlay network, but can be disabled by publishing ports in `host` mode instead of `ingress` mode (allowing the use of an external load balancer), and removing the `ingress` network. If encrypted overlay networks are in exclusive use, block UDP port 4789 from traffic that has not been validated by IPSec.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-28842",
          "url": "https://www.suse.com/security/cve/CVE-2023-28842"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1214109 for CVE-2023-28842",
          "url": "https://bugzilla.suse.com/1214109"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215525 for CVE-2023-28842",
          "url": "https://bugzilla.suse.com/1215525"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-28842"
    },
    {
      "cve": "CVE-2024-23651",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-23651"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container. The issue has been fixed in v0.12.5. Workarounds include, avoiding using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with --mount=type=cache,source=... options.\n",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-23651",
          "url": "https://www.suse.com/security/cve/CVE-2024-23651"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1219267 for CVE-2024-23651",
          "url": "https://bugzilla.suse.com/1219267"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-23651"
    },
    {
      "cve": "CVE-2024-23652",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-23652"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
          "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-23652",
          "url": "https://www.suse.com/security/cve/CVE-2024-23652"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1219268 for CVE-2024-23652",
          "url": "https://bugzilla.suse.com/1219268"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1.x86_64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.aarch64",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.ppc64le",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.s390x",
            "openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-09-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-23652"
    }
  ]
}

CVE-2018-16873 (GCVE-0-2018-16873)

Vulnerability from cvelistv5

Published

2018-12-14 14:00

Modified

2024-08-05 10:32

Severity ?

7.5 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-20

Summary

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".

References

URL

Tags

	http://www.securityfocus.com/bid/106226	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201812-09	vendor-advisory, x_refsource_GENTOO
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16873	x_refsource_CONFIRM
	https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html	vendor-advisory, x_refsource_SUSE
	https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	[UNKNOWN]	golang	Version: 1.10.6 Version: 1.11.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:32:54.055Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "106226",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106226"
          },
          {
            "name": "GLSA-201812-09",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201812-09"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16873"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0"
          },
          {
            "name": "openSUSE-SU-2019:1079",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html"
          },
          {
            "name": "openSUSE-SU-2019:1444",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html"
          },
          {
            "name": "openSUSE-SU-2019:1499",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html"
          },
          {
            "name": "openSUSE-SU-2019:1506",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html"
          },
          {
            "name": "openSUSE-SU-2019:1703",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html"
          },
          {
            "name": "openSUSE-SU-2020:0554",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html"
          },
          {
            "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
          },
          {
            "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "golang",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "1.10.6"
            },
            {
              "status": "affected",
              "version": "1.11.3"
            }
          ]
        }
      ],
      "datePublic": "2018-12-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it\u0027s possible to arrange things so that a Git repository is cloned to a folder named \".git\" by using a vanity import path that ends with \"/.git\". If the Git repository root contains a \"HEAD\" file, a \"config\" file, an \"objects\" directory, a \"refs\" directory, with some work to ensure the proper ordering of operations, \"go get -u\" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the \"config\" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running \"go get -u\"."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-13T20:06:33",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "106226",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106226"
        },
        {
          "name": "GLSA-201812-09",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201812-09"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16873"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0"
        },
        {
          "name": "openSUSE-SU-2019:1079",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html"
        },
        {
          "name": "openSUSE-SU-2019:1444",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html"
        },
        {
          "name": "openSUSE-SU-2019:1499",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html"
        },
        {
          "name": "openSUSE-SU-2019:1506",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html"
        },
        {
          "name": "openSUSE-SU-2019:1703",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html"
        },
        {
          "name": "openSUSE-SU-2020:0554",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html"
        },
        {
          "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
        },
        {
          "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-16873",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "golang",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.10.6"
                          },
                          {
                            "version_value": "1.11.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "[UNKNOWN]"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it\u0027s possible to arrange things so that a Git repository is cloned to a folder named \".git\" by using a vanity import path that ends with \"/.git\". If the Git repository root contains a \"HEAD\" file, a \"config\" file, an \"objects\" directory, a \"refs\" directory, with some work to ensure the proper ordering of operations, \"go get -u\" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the \"config\" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running \"go get -u\"."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "7.5/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "106226",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106226"
            },
            {
              "name": "GLSA-201812-09",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201812-09"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16873",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16873"
            },
            {
              "name": "https://groups.google.com/forum/?pli=1#!topic/golang-announce/Kw31K8G7Fi0",
              "refsource": "MISC",
              "url": "https://groups.google.com/forum/?pli=1#!topic/golang-announce/Kw31K8G7Fi0"
            },
            {
              "name": "openSUSE-SU-2019:1079",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html"
            },
            {
              "name": "openSUSE-SU-2019:1444",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html"
            },
            {
              "name": "openSUSE-SU-2019:1499",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html"
            },
            {
              "name": "openSUSE-SU-2019:1506",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html"
            },
            {
              "name": "openSUSE-SU-2019:1703",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html"
            },
            {
              "name": "openSUSE-SU-2020:0554",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html"
            },
            {
              "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
            },
            {
              "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-16873",
    "datePublished": "2018-12-14T14:00:00",
    "dateReserved": "2018-09-11T00:00:00",
    "dateUpdated": "2024-08-05T10:32:54.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-28841 (GCVE-0-2023-28841)

Vulnerability from cvelistv5

Published

2023-04-04 21:12

Modified

2025-02-13 16:48

Severity ?

6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

CWE

CWE-311 - Missing Encryption of Sensitive Data
CWE-636 - Not Failing Securely ('Failing Open')

Summary

Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. An iptables rule designates outgoing VXLAN datagrams with a VNI that corresponds to an encrypted overlay network for IPsec encapsulation. Encrypted overlay networks on affected platforms silently transmit unencrypted data. As a result, `overlay` networks may appear to be functional, passing traffic as expected, but without any of the expected confidentiality or data integrity guarantees. It is possible for an attacker sitting in a trusted position on the network to read all of the application traffic that is moving across the overlay network, resulting in unexpected secrets or user data disclosure. Thus, because many database protocols, internal APIs, etc. are not protected by a second layer of encryption, a user may use Swarm encrypted overlay networks to provide confidentiality, which due to this vulnerability this is no longer guaranteed. Patches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some workarounds are available. Close the VXLAN port (by default, UDP port 4789) to outgoing traffic at the Internet boundary in order to prevent unintentionally leaking unencrypted traffic over the Internet, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster.

References

URL

Tags

	https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237	x_refsource_CONFIRM
	https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333	x_refsource_MISC
	https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp	x_refsource_MISC
	https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p	x_refsource_MISC
	https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw	x_refsource_MISC
	https://github.com/moby/moby/issues/43382	x_refsource_MISC
	https://github.com/moby/moby/pull/45118	x_refsource_MISC
	https://github.com/moby/libnetwork/blob/d9fae4c73daf76c3b0f77e14b45b8bf612ba764d/drivers/overlay/encryption.go#L205-L207	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/

Impacted products

	Vendor	Product	Version
	moby	moby	Version: >= 1.12.0, < 20.10.24 Version: >= 23.0.0, < 23.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T13:51:38.268Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237"
          },
          {
            "name": "https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333"
          },
          {
            "name": "https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp"
          },
          {
            "name": "https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p"
          },
          {
            "name": "https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw"
          },
          {
            "name": "https://github.com/moby/moby/issues/43382",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/issues/43382"
          },
          {
            "name": "https://github.com/moby/moby/pull/45118",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/pull/45118"
          },
          {
            "name": "https://github.com/moby/libnetwork/blob/d9fae4c73daf76c3b0f77e14b45b8bf612ba764d/drivers/overlay/encryption.go#L205-L207",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/libnetwork/blob/d9fae4c73daf76c3b0f77e14b45b8bf612ba764d/drivers/overlay/encryption.go#L205-L207"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-28841",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-10T21:32:19.333443Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-10T21:32:23.447Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moby",
          "vendor": "moby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.12.0, \u003c 20.10.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 23.0.0, \u003c 23.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*.\n\nSwarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code.\n\nThe `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes.\n\nEncrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption.\n\nWhen setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet\u0027s VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN.\n\nAn iptables rule designates outgoing VXLAN datagrams with a VNI that corresponds to an encrypted overlay network for IPsec encapsulation.\n\nEncrypted overlay networks on affected platforms silently transmit unencrypted data. As a result, `overlay` networks may appear to be functional, passing traffic as expected, but without any of the expected confidentiality or data integrity guarantees.\n\nIt is possible for an attacker sitting in a trusted position on the network to read all of the application traffic that is moving across the overlay network, resulting in unexpected secrets or user data disclosure. Thus, because many database protocols, internal APIs, etc. are not protected by a second layer of encryption, a user may use Swarm encrypted overlay networks to provide confidentiality, which due to this vulnerability this is no longer guaranteed.\n\nPatches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime\u0027s 20.10 releases are numbered differently, users of that platform should update to 20.10.16.\n\nSome workarounds are available. Close the VXLAN port (by default, UDP port 4789) to outgoing traffic at the Internet boundary in order to prevent unintentionally leaking unencrypted traffic over the Internet, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-311",
              "description": "CWE-311: Missing Encryption of Sensitive Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-636",
              "description": "CWE-636: Not Failing Securely (\u0027Failing Open\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-15T20:06:27.951Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237"
        },
        {
          "name": "https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333"
        },
        {
          "name": "https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp"
        },
        {
          "name": "https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p"
        },
        {
          "name": "https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw"
        },
        {
          "name": "https://github.com/moby/moby/issues/43382",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/issues/43382"
        },
        {
          "name": "https://github.com/moby/moby/pull/45118",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/pull/45118"
        },
        {
          "name": "https://github.com/moby/libnetwork/blob/d9fae4c73daf76c3b0f77e14b45b8bf612ba764d/drivers/overlay/encryption.go#L205-L207",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/libnetwork/blob/d9fae4c73daf76c3b0f77e14b45b8bf612ba764d/drivers/overlay/encryption.go#L205-L207"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/"
        }
      ],
      "source": {
        "advisory": "GHSA-33pg-m6jh-5237",
        "discovery": "UNKNOWN"
      },
      "title": "moby/moby\u0027s dockerd daemon encrypted overlay network traffic may be unencrypted"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-28841",
    "datePublished": "2023-04-04T21:12:17.406Z",
    "dateReserved": "2023-03-24T16:25:34.466Z",
    "dateUpdated": "2025-02-13T16:48:54.707Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-3629 (GCVE-0-2015-3629)

Vulnerability from cvelistv5

Published

2015-05-18 15:00

Modified

2024-08-06 05:47

Severity ?

CWE

Summary

Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.

References

URL

Tags

	https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ	x_refsource_CONFIRM
	http://seclists.org/fulldisclosure/2015/May/28	mailing-list, x_refsource_FULLDISC
	http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html	vendor-advisory, x_refsource_SUSE
	http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html	x_refsource_MISC
	http://www.securityfocus.com/bid/74558	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:47:57.819Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ"
          },
          {
            "name": "20150508 Docker 1.6.1 - Security Advisory [150507]",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2015/May/28"
          },
          {
            "name": "openSUSE-SU-2015:0905",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html"
          },
          {
            "name": "74558",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/74558"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-05-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization (\"mount namespace breakout\") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-30T15:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ"
        },
        {
          "name": "20150508 Docker 1.6.1 - Security Advisory [150507]",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2015/May/28"
        },
        {
          "name": "openSUSE-SU-2015:0905",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html"
        },
        {
          "name": "74558",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/74558"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-3629",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization (\"mount namespace breakout\") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/forum/#!searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ"
            },
            {
              "name": "20150508 Docker 1.6.1 - Security Advisory [150507]",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2015/May/28"
            },
            {
              "name": "openSUSE-SU-2015:0905",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html"
            },
            {
              "name": "74558",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/74558"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-3629",
    "datePublished": "2015-05-18T15:00:00",
    "dateReserved": "2015-05-01T00:00:00",
    "dateUpdated": "2024-08-06T05:47:57.819Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-3499 (GCVE-0-2014-3499)

Vulnerability from cvelistv5

Published

2014-07-11 14:00

Modified

2024-08-06 10:43

Severity ?

CWE

Summary

Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

References

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=1111687	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2014-0820.html	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:43:06.319Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1111687"
          },
          {
            "name": "RHSA-2014:0820",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-0820.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-07-01T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-07-11T13:57:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1111687"
        },
        {
          "name": "RHSA-2014:0820",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-0820.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-3499",
    "datePublished": "2014-07-11T14:00:00",
    "dateReserved": "2014-05-14T00:00:00",
    "dateUpdated": "2024-08-06T10:43:06.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-6407 (GCVE-0-2014-6407)

Vulnerability from cvelistv5

Published

2014-12-12 15:00

Modified

2024-08-06 12:17

Severity ?

CWE

Summary

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.

References

URL

Tags

	http://secunia.com/advisories/60241	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/60171	third-party-advisory, x_refsource_SECUNIA
	https://docs.docker.com/v1.3/release-notes/	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html	vendor-advisory, x_refsource_SUSE
	http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html	vendor-advisory, x_refsource_FEDORA
	http://www.openwall.com/lists/oss-security/2014/11/24/5	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T12:17:23.673Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "60241",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60241"
          },
          {
            "name": "60171",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60171"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://docs.docker.com/v1.3/release-notes/"
          },
          {
            "name": "openSUSE-SU-2014:1596",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html"
          },
          {
            "name": "FEDORA-2014-15779",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html"
          },
          {
            "name": "[oss-security] 20141124 Docker 1.3.2 - Security Advisory [24 Nov 2014]",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2014/11/24/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-11-24T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-12-12T13:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "60241",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60241"
        },
        {
          "name": "60171",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60171"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://docs.docker.com/v1.3/release-notes/"
        },
        {
          "name": "openSUSE-SU-2014:1596",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html"
        },
        {
          "name": "FEDORA-2014-15779",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html"
        },
        {
          "name": "[oss-security] 20141124 Docker 1.3.2 - Security Advisory [24 Nov 2014]",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2014/11/24/5"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-6407",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "60241",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60241"
            },
            {
              "name": "60171",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60171"
            },
            {
              "name": "https://docs.docker.com/v1.3/release-notes/",
              "refsource": "CONFIRM",
              "url": "https://docs.docker.com/v1.3/release-notes/"
            },
            {
              "name": "openSUSE-SU-2014:1596",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html"
            },
            {
              "name": "FEDORA-2014-15779",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html"
            },
            {
              "name": "[oss-security] 20141124 Docker 1.3.2 - Security Advisory [24 Nov 2014]",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2014/11/24/5"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-6407",
    "datePublished": "2014-12-12T15:00:00",
    "dateReserved": "2014-09-15T00:00:00",
    "dateUpdated": "2024-08-06T12:17:23.673Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-15257 (GCVE-0-2020-15257)

Vulnerability from cvelistv5

Published

2020-12-01 02:30

Modified

2024-08-04 13:15

Severity ?

5.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE

CWE-669 - Incorrect Resource Transfer Between Spheres

Summary

containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container.

References

URL

Tags

	https://github.com/containerd/containerd/security/advisories/GHSA-36xw-fx78-c5r4	x_refsource_CONFIRM
	https://github.com/containerd/containerd/commit/4a4bb851f5da563ff6e68a83dc837c7699c469ad	x_refsource_MISC
	https://github.com/containerd/containerd/releases/tag/v1.4.3	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNKXLOLZWO5FMAPX63ZL7JNKTNNT5NQD/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-4865	vendor-advisory, x_refsource_DEBIAN
	https://security.gentoo.org/glsa/202105-33	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	containerd	containerd	Version: < 1.3.9 Version: >= 1.4.0, < 1.4.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:15:19.030Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/containerd/containerd/security/advisories/GHSA-36xw-fx78-c5r4"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/containerd/containerd/commit/4a4bb851f5da563ff6e68a83dc837c7699c469ad"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/containerd/containerd/releases/tag/v1.4.3"
          },
          {
            "name": "FEDORA-2020-baeb8dbaea",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNKXLOLZWO5FMAPX63ZL7JNKTNNT5NQD/"
          },
          {
            "name": "DSA-4865",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4865"
          },
          {
            "name": "GLSA-202105-33",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202105-33"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "containerd",
          "vendor": "containerd",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.4.0, \u003c 1.4.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim\u2019s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the \"host\" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container\u0027s privilege, regardless of what container runtime is used for running that container."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-669",
              "description": "CWE-669 Incorrect Resource Transfer Between Spheres",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-26T11:08:46",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/containerd/containerd/security/advisories/GHSA-36xw-fx78-c5r4"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/containerd/containerd/commit/4a4bb851f5da563ff6e68a83dc837c7699c469ad"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/containerd/containerd/releases/tag/v1.4.3"
        },
        {
          "name": "FEDORA-2020-baeb8dbaea",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNKXLOLZWO5FMAPX63ZL7JNKTNNT5NQD/"
        },
        {
          "name": "DSA-4865",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4865"
        },
        {
          "name": "GLSA-202105-33",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202105-33"
        }
      ],
      "source": {
        "advisory": "GHSA-36xw-fx78-c5r4",
        "discovery": "UNKNOWN"
      },
      "title": "containerd-shim API Exposed to Host Network Containers",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15257",
          "STATE": "PUBLIC",
          "TITLE": "containerd-shim API Exposed to Host Network Containers"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "containerd",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.3.9"
                          },
                          {
                            "version_value": "\u003e= 1.4.0, \u003c 1.4.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "containerd"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim\u2019s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the \"host\" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container\u0027s privilege, regardless of what container runtime is used for running that container."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-669 Incorrect Resource Transfer Between Spheres"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/containerd/containerd/security/advisories/GHSA-36xw-fx78-c5r4",
              "refsource": "CONFIRM",
              "url": "https://github.com/containerd/containerd/security/advisories/GHSA-36xw-fx78-c5r4"
            },
            {
              "name": "https://github.com/containerd/containerd/commit/4a4bb851f5da563ff6e68a83dc837c7699c469ad",
              "refsource": "MISC",
              "url": "https://github.com/containerd/containerd/commit/4a4bb851f5da563ff6e68a83dc837c7699c469ad"
            },
            {
              "name": "https://github.com/containerd/containerd/releases/tag/v1.4.3",
              "refsource": "MISC",
              "url": "https://github.com/containerd/containerd/releases/tag/v1.4.3"
            },
            {
              "name": "FEDORA-2020-baeb8dbaea",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNKXLOLZWO5FMAPX63ZL7JNKTNNT5NQD/"
            },
            {
              "name": "DSA-4865",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4865"
            },
            {
              "name": "GLSA-202105-33",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202105-33"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-36xw-fx78-c5r4",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15257",
    "datePublished": "2020-12-01T02:30:16",
    "dateReserved": "2020-06-25T00:00:00",
    "dateUpdated": "2024-08-04T13:15:19.030Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-41092 (GCVE-0-2021-41092)

Vulnerability from cvelistv5

Published

2021-10-04 20:10

Modified

2024-08-04 02:59

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Summary

Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.

References

URL

Tags

	https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v	x_refsource_CONFIRM
	https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/	vendor-advisory, x_refsource_FEDORA
	https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	docker	cli	Version: < 20.10.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T02:59:31.334Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b"
          },
          {
            "name": "FEDORA-2021-df975338d4",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/"
          },
          {
            "name": "FEDORA-2021-b5a9a481a2",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cli",
          "vendor": "docker",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.10.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-14T10:06:52",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b"
        },
        {
          "name": "FEDORA-2021-df975338d4",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/"
        },
        {
          "name": "FEDORA-2021-b5a9a481a2",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
        }
      ],
      "source": {
        "advisory": "GHSA-99pg-grm5-qq3v",
        "discovery": "UNKNOWN"
      },
      "title": "Docker CLI leaks private registry credentials to registry-1.docker.io",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-41092",
          "STATE": "PUBLIC",
          "TITLE": "Docker CLI leaks private registry credentials to registry-1.docker.io"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "cli",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 20.10.9"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "docker"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v",
              "refsource": "CONFIRM",
              "url": "https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v"
            },
            {
              "name": "https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b",
              "refsource": "MISC",
              "url": "https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b"
            },
            {
              "name": "FEDORA-2021-df975338d4",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/"
            },
            {
              "name": "FEDORA-2021-b5a9a481a2",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-99pg-grm5-qq3v",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-41092",
    "datePublished": "2021-10-04T20:10:10",
    "dateReserved": "2021-09-15T00:00:00",
    "dateUpdated": "2024-08-04T02:59:31.334Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-9962 (GCVE-0-2016-9962)

Vulnerability from cvelistv5

Published

2017-01-31 22:00

Modified

2024-08-06 03:07

Severity ?

CWE

Summary

RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.

References

URL

Tags

	http://www.securityfocus.com/bid/95361	vdb-entry, x_refsource_BID
	https://github.com/docker/docker/releases/tag/v1.12.6	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2017-0116.html	vendor-advisory, x_refsource_REDHAT
	http://seclists.org/fulldisclosure/2017/Jan/29	mailing-list, x_refsource_FULLDISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WUQ3MQNEL5IBZZLMLR72Q4YDCL2SCKRK/	vendor-advisory, x_refsource_FEDORA
	https://bugzilla.suse.com/show_bug.cgi?id=1012568#c6	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201701-34	vendor-advisory, x_refsource_GENTOO
	http://rhn.redhat.com/errata/RHSA-2017-0123.html	vendor-advisory, x_refsource_REDHAT
	https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3dacde268afe5	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2017-0127.html	vendor-advisory, x_refsource_REDHAT
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FINGBFMIXBG6B6ZWYH3TMRP5V3PDBNXR/	vendor-advisory, x_refsource_FEDORA
	https://access.redhat.com/security/vulnerabilities/cve-2016-9962	x_refsource_CONFIRM
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAXJMMLRU7DD2IMG47SR2K4BOFFG7FZ/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVM7FCOQMPKOFLDTUYSS4ES76DDM56VP/	vendor-advisory, x_refsource_FEDORA
	http://www.securityfocus.com/archive/1/540001/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://seclists.org/fulldisclosure/2017/Jan/21	mailing-list, x_refsource_FULLDISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T03:07:31.309Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "95361",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95361"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/docker/docker/releases/tag/v1.12.6"
          },
          {
            "name": "RHSA-2017:0116",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-0116.html"
          },
          {
            "name": "20170111 Re: [oss-security] Docker 1.12.6 - Security Advisory",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2017/Jan/29"
          },
          {
            "name": "FEDORA-2017-fcd02e2c2d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WUQ3MQNEL5IBZZLMLR72Q4YDCL2SCKRK/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1012568#c6"
          },
          {
            "name": "GLSA-201701-34",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201701-34"
          },
          {
            "name": "RHSA-2017:0123",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-0123.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3dacde268afe5"
          },
          {
            "name": "RHSA-2017:0127",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-0127.html"
          },
          {
            "name": "FEDORA-2017-c2c2d1be16",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FINGBFMIXBG6B6ZWYH3TMRP5V3PDBNXR/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/vulnerabilities/cve-2016-9962"
          },
          {
            "name": "FEDORA-2017-dbc2b618eb",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAXJMMLRU7DD2IMG47SR2K4BOFFG7FZ/"
          },
          {
            "name": "FEDORA-2017-0200646669",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVM7FCOQMPKOFLDTUYSS4ES76DDM56VP/"
          },
          {
            "name": "20170111 Re: [oss-security] Docker 1.12.6 - Security Advisory",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/540001/100/0/threaded"
          },
          {
            "name": "20170110 Docker 1.12.6 - Security Advisory",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2017/Jan/21"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-01-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "RunC allowed additional container processes via \u0027runc exec\u0027 to be ptraced by the pid 1 of the container.  This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "95361",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95361"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/docker/docker/releases/tag/v1.12.6"
        },
        {
          "name": "RHSA-2017:0116",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-0116.html"
        },
        {
          "name": "20170111 Re: [oss-security] Docker 1.12.6 - Security Advisory",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2017/Jan/29"
        },
        {
          "name": "FEDORA-2017-fcd02e2c2d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WUQ3MQNEL5IBZZLMLR72Q4YDCL2SCKRK/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1012568#c6"
        },
        {
          "name": "GLSA-201701-34",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201701-34"
        },
        {
          "name": "RHSA-2017:0123",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-0123.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3dacde268afe5"
        },
        {
          "name": "RHSA-2017:0127",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-0127.html"
        },
        {
          "name": "FEDORA-2017-c2c2d1be16",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FINGBFMIXBG6B6ZWYH3TMRP5V3PDBNXR/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://access.redhat.com/security/vulnerabilities/cve-2016-9962"
        },
        {
          "name": "FEDORA-2017-dbc2b618eb",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAXJMMLRU7DD2IMG47SR2K4BOFFG7FZ/"
        },
        {
          "name": "FEDORA-2017-0200646669",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVM7FCOQMPKOFLDTUYSS4ES76DDM56VP/"
        },
        {
          "name": "20170111 Re: [oss-security] Docker 1.12.6 - Security Advisory",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/540001/100/0/threaded"
        },
        {
          "name": "20170110 Docker 1.12.6 - Security Advisory",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2017/Jan/21"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-9962",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "RunC allowed additional container processes via \u0027runc exec\u0027 to be ptraced by the pid 1 of the container.  This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "95361",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/95361"
            },
            {
              "name": "https://github.com/docker/docker/releases/tag/v1.12.6",
              "refsource": "CONFIRM",
              "url": "https://github.com/docker/docker/releases/tag/v1.12.6"
            },
            {
              "name": "RHSA-2017:0116",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2017-0116.html"
            },
            {
              "name": "20170111 Re: [oss-security] Docker 1.12.6 - Security Advisory",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2017/Jan/29"
            },
            {
              "name": "FEDORA-2017-fcd02e2c2d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WUQ3MQNEL5IBZZLMLR72Q4YDCL2SCKRK/"
            },
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1012568#c6",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1012568#c6"
            },
            {
              "name": "GLSA-201701-34",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201701-34"
            },
            {
              "name": "RHSA-2017:0123",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2017-0123.html"
            },
            {
              "name": "https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3dacde268afe5",
              "refsource": "CONFIRM",
              "url": "https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3dacde268afe5"
            },
            {
              "name": "RHSA-2017:0127",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2017-0127.html"
            },
            {
              "name": "FEDORA-2017-c2c2d1be16",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FINGBFMIXBG6B6ZWYH3TMRP5V3PDBNXR/"
            },
            {
              "name": "https://access.redhat.com/security/vulnerabilities/cve-2016-9962",
              "refsource": "CONFIRM",
              "url": "https://access.redhat.com/security/vulnerabilities/cve-2016-9962"
            },
            {
              "name": "FEDORA-2017-dbc2b618eb",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAXJMMLRU7DD2IMG47SR2K4BOFFG7FZ/"
            },
            {
              "name": "FEDORA-2017-0200646669",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVM7FCOQMPKOFLDTUYSS4ES76DDM56VP/"
            },
            {
              "name": "20170111 Re: [oss-security] Docker 1.12.6 - Security Advisory",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/540001/100/0/threaded"
            },
            {
              "name": "20170110 Docker 1.12.6 - Security Advisory",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2017/Jan/21"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-9962",
    "datePublished": "2017-01-31T22:00:00",
    "dateReserved": "2016-12-15T00:00:00",
    "dateUpdated": "2024-08-06T03:07:31.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24769 (GCVE-0-2022-24769)

Vulnerability from cvelistv5

Published

2022-03-24 00:00

Modified

2024-08-03 04:20

Severity ?

5.9 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Summary

Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a workaround, the entry point of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting.

References

URL

Tags

	https://github.com/moby/moby/security/advisories/GHSA-2mm7-x5h6-5pvq
	https://github.com/moby/moby/commit/2bbc786e4c59761d722d2d1518cd0a32829bc07f
	https://github.com/moby/moby/releases/tag/v20.10.14
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPOJUJZXGMIVKRS4QR75F6OIXNQ6LDBL/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PMQKCAPK2AR3DCYITJYMMNBEGQBGLCC/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5FQJ3MLFSEKQYCFPFZIKYGBXPZUJFVY/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5AFKOQ5CE3CEIULWW4FLQKHFFU6FSYG/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIMAHZ6AUIKN7AX26KHZYBXVECIOVWBH/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQCVS7WBFSTKJFNX5PGDRARMTOFWV2O7/	vendor-advisory
	http://www.openwall.com/lists/oss-security/2022/05/12/1	mailing-list
	https://www.debian.org/security/2022/dsa-5162	vendor-advisory
	https://security.gentoo.org/glsa/202401-31	vendor-advisory

Impacted products

	Vendor	Product	Version
	moby	moby	Version: < 20.10.14

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:20:49.949Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-2mm7-x5h6-5pvq"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/commit/2bbc786e4c59761d722d2d1518cd0a32829bc07f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/releases/tag/v20.10.14"
          },
          {
            "name": "FEDORA-2022-e9a09c1a7d",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPOJUJZXGMIVKRS4QR75F6OIXNQ6LDBL/"
          },
          {
            "name": "FEDORA-2022-ed53f2439a",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PMQKCAPK2AR3DCYITJYMMNBEGQBGLCC/"
          },
          {
            "name": "FEDORA-2022-c07546070d",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5FQJ3MLFSEKQYCFPFZIKYGBXPZUJFVY/"
          },
          {
            "name": "FEDORA-2022-cac2323802",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5AFKOQ5CE3CEIULWW4FLQKHFFU6FSYG/"
          },
          {
            "name": "FEDORA-2022-eda0049dd7",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIMAHZ6AUIKN7AX26KHZYBXVECIOVWBH/"
          },
          {
            "name": "FEDORA-2022-3826c8f549",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQCVS7WBFSTKJFNX5PGDRARMTOFWV2O7/"
          },
          {
            "name": "[oss-security] 20220512 CVE-2022-29162: runc \u003c 1.1.2 incorrect handling of inheritable capabilities in default configuration",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/05/12/1"
          },
          {
            "name": "DSA-5162",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5162"
          },
          {
            "name": "GLSA-202401-31",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-31"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moby",
          "vendor": "moby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.10.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container\u0027s bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container\u0027s bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a workaround, the entry point of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-31T13:06:22.056004",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/moby/moby/security/advisories/GHSA-2mm7-x5h6-5pvq"
        },
        {
          "url": "https://github.com/moby/moby/commit/2bbc786e4c59761d722d2d1518cd0a32829bc07f"
        },
        {
          "url": "https://github.com/moby/moby/releases/tag/v20.10.14"
        },
        {
          "name": "FEDORA-2022-e9a09c1a7d",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPOJUJZXGMIVKRS4QR75F6OIXNQ6LDBL/"
        },
        {
          "name": "FEDORA-2022-ed53f2439a",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PMQKCAPK2AR3DCYITJYMMNBEGQBGLCC/"
        },
        {
          "name": "FEDORA-2022-c07546070d",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5FQJ3MLFSEKQYCFPFZIKYGBXPZUJFVY/"
        },
        {
          "name": "FEDORA-2022-cac2323802",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5AFKOQ5CE3CEIULWW4FLQKHFFU6FSYG/"
        },
        {
          "name": "FEDORA-2022-eda0049dd7",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIMAHZ6AUIKN7AX26KHZYBXVECIOVWBH/"
        },
        {
          "name": "FEDORA-2022-3826c8f549",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQCVS7WBFSTKJFNX5PGDRARMTOFWV2O7/"
        },
        {
          "name": "[oss-security] 20220512 CVE-2022-29162: runc \u003c 1.1.2 incorrect handling of inheritable capabilities in default configuration",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/05/12/1"
        },
        {
          "name": "DSA-5162",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5162"
        },
        {
          "name": "GLSA-202401-31",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202401-31"
        }
      ],
      "source": {
        "advisory": "GHSA-2mm7-x5h6-5pvq",
        "discovery": "UNKNOWN"
      },
      "title": "Default inheritable capabilities for linux container should be empty"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-24769",
    "datePublished": "2022-03-24T00:00:00",
    "dateReserved": "2022-02-10T00:00:00",
    "dateUpdated": "2024-08-03T04:20:49.949Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-20699 (GCVE-0-2018-20699)

Vulnerability from cvelistv5

Published

2019-01-12 02:00

Modified

2024-08-05 12:05

Severity ?

CWE

Summary

Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.

References

URL

Tags

	https://github.com/docker/engine/pull/70	x_refsource_MISC
	https://github.com/moby/moby/pull/37967	x_refsource_MISC
	https://access.redhat.com/errata/RHSA-2019:0487	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:05:17.865Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/docker/engine/pull/70"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/pull/37967"
          },
          {
            "name": "RHSA-2019:0487",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:0487"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-01-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-03-13T09:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/docker/engine/pull/70"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/pull/37967"
        },
        {
          "name": "RHSA-2019:0487",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:0487"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-20699",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/docker/engine/pull/70",
              "refsource": "MISC",
              "url": "https://github.com/docker/engine/pull/70"
            },
            {
              "name": "https://github.com/moby/moby/pull/37967",
              "refsource": "MISC",
              "url": "https://github.com/moby/moby/pull/37967"
            },
            {
              "name": "RHSA-2019:0487",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:0487"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-20699",
    "datePublished": "2019-01-12T02:00:00",
    "dateReserved": "2019-01-11T00:00:00",
    "dateUpdated": "2024-08-05T12:05:17.865Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-12912 (GCVE-0-2020-12912)

Vulnerability from cvelistv5

Published

2020-11-12 19:08

Modified

2024-08-04 12:11

Severity ?

CWE

CWE-749 - Exposed Dangerous Method or Function

Summary

A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access.

References

URL

Tags

https://www.amd.com/en/corporate/product-security

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	AMD extension to Linux "hwmon" for Zen1 platforms	Version: Each Linux distro determines its own version.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:11:18.792Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AMD extension to Linux \"hwmon\" for Zen1 platforms",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Each Linux distro determines its own version."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A potential vulnerability in the AMD extension to Linux \"hwmon\" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749: Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-12T19:08:57",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.amd.com/en/corporate/product-security"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@amd.com",
          "ID": "CVE-2020-12912",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "AMD extension to Linux \"hwmon\" for Zen1 platforms",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Each Linux distro determines its own version."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A potential vulnerability in the AMD extension to Linux \"hwmon\" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-749: Exposed Dangerous Method or Function"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.amd.com/en/corporate/product-security",
              "refsource": "MISC",
              "url": "https://www.amd.com/en/corporate/product-security"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2020-12912",
    "datePublished": "2020-11-12T19:08:57",
    "dateReserved": "2020-05-15T00:00:00",
    "dateUpdated": "2024-08-04T12:11:18.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-9358 (GCVE-0-2014-9358)

Vulnerability from cvelistv5

Published

2014-12-16 18:00

Modified

2024-08-06 13:40

Severity ?

CWE

Summary

Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."

References

URL

Tags

	https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ	x_refsource_CONFIRM
	http://www.securityfocus.com/archive/1/534215/100/0/threaded	mailing-list, x_refsource_BUGTRAQ

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:40:25.168Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ"
          },
          {
            "name": "20141212 Docker 1.3.3 - Security Advisory [11 Dec 2014]",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/534215/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-12-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) \"docker load\" operation or (2) \"registry communications.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ"
        },
        {
          "name": "20141212 Docker 1.3.3 - Security Advisory [11 Dec 2014]",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/534215/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-9358",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) \"docker load\" operation or (2) \"registry communications.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/forum/#!msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ"
            },
            {
              "name": "20141212 Docker 1.3.3 - Security Advisory [11 Dec 2014]",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/534215/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-9358",
    "datePublished": "2014-12-16T18:00:00",
    "dateReserved": "2014-12-09T00:00:00",
    "dateUpdated": "2024-08-06T13:40:25.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-28840 (GCVE-0-2023-28840)

Vulnerability from cvelistv5

Published

2023-04-04 21:13

Modified

2025-02-13 16:48

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L

CWE

CWE-420 - Unprotected Alternate Channel
CWE-636 - Not Failing Securely ('Failing Open')

Summary

Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in dockerd and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The overlay network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the u32 iptables extension provided by the xt_u32 kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. Two iptables rules serve to filter incoming VXLAN datagrams with a VNI that corresponds to an encrypted network and discards unencrypted datagrams. The rules are appended to the end of the INPUT filter chain, following any rules that have been previously set by the system administrator. Administrator-set rules take precedence over the rules Moby sets to discard unencrypted VXLAN datagrams, which can potentially admit unencrypted datagrams that should have been discarded. The injection of arbitrary Ethernet frames can enable a Denial of Service attack. A sophisticated attacker may be able to establish a UDP or TCP connection by way of the container’s outbound gateway that would otherwise be blocked by a stateful firewall, or carry out other escalations beyond simple injection by smuggling packets into the overlay network. Patches are available in Moby releases 23.0.3 and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some workarounds are available. Close the VXLAN port (by default, UDP port 4789) to incoming traffic at the Internet boundary to prevent all VXLAN packet injection, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster.

References

URL

Tags

	https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp	x_refsource_CONFIRM
	https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333	x_refsource_MISC
	https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237	x_refsource_MISC
	https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p	x_refsource_MISC
	https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw	x_refsource_MISC
	https://github.com/moby/moby/issues/43382	x_refsource_MISC
	https://github.com/moby/moby/pull/45118	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/

Impacted products

	Vendor	Product	Version
	moby	moby	Version: >= 1.12.0, < 20.10.24 Version: >= 23.0.0, < 23.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T13:51:38.250Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp"
          },
          {
            "name": "https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333"
          },
          {
            "name": "https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237"
          },
          {
            "name": "https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p"
          },
          {
            "name": "https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw"
          },
          {
            "name": "https://github.com/moby/moby/issues/43382",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/issues/43382"
          },
          {
            "name": "https://github.com/moby/moby/pull/45118",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/pull/45118"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-28840",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-10T21:31:15.735065Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-10T21:31:41.188Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moby",
          "vendor": "moby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.12.0, \u003c 20.10.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 23.0.0, \u003c 23.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly referred to as *Docker*.\n\nSwarm Mode, which is compiled in and delivered by default in dockerd and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code.\n\nThe overlay network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes.\n\nEncrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption.\n\nWhen setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the u32 iptables extension provided by the xt_u32 kernel module to directly filter on a VXLAN packet\u0027s VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN.\n\nTwo iptables rules serve to filter incoming VXLAN datagrams with a VNI that corresponds to an encrypted network and discards unencrypted datagrams. The rules are appended to the end of the INPUT filter chain, following any rules that have been previously set by the system administrator. Administrator-set rules take precedence over the rules Moby sets to discard unencrypted VXLAN datagrams, which can potentially admit unencrypted datagrams that should have been discarded.\n\nThe injection of arbitrary Ethernet frames can enable a Denial of Service attack. A sophisticated attacker may be able to establish a UDP or TCP connection by way of the container\u2019s outbound gateway that would otherwise be blocked by a stateful firewall, or carry out other escalations beyond simple injection by smuggling packets into the overlay network.\n\nPatches are available in Moby releases 23.0.3 and 20.10.24. As Mirantis Container Runtime\u0027s 20.10 releases are numbered differently, users of that platform should update to 20.10.16.\n\nSome workarounds are available. Close the VXLAN port (by default, UDP port 4789) to incoming traffic at the Internet boundary to prevent all VXLAN packet injection, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-420",
              "description": "CWE-420: Unprotected Alternate Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-636",
              "description": "CWE-636: Not Failing Securely (\u0027Failing Open\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-15T20:06:20.926Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp"
        },
        {
          "name": "https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333"
        },
        {
          "name": "https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237"
        },
        {
          "name": "https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p"
        },
        {
          "name": "https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw"
        },
        {
          "name": "https://github.com/moby/moby/issues/43382",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/issues/43382"
        },
        {
          "name": "https://github.com/moby/moby/pull/45118",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/pull/45118"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/"
        }
      ],
      "source": {
        "advisory": "GHSA-232p-vwff-86mp",
        "discovery": "UNKNOWN"
      },
      "title": "moby/moby\u0027s dockerd daemon encrypted overlay network may be unauthenticated"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-28840",
    "datePublished": "2023-04-04T21:13:03.347Z",
    "dateReserved": "2023-03-24T16:25:34.466Z",
    "dateUpdated": "2025-02-13T16:48:53.710Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-13509 (GCVE-0-2019-13509)

Vulnerability from cvelistv5

Published

2019-07-18 15:34

Modified

2024-08-04 23:57

Severity ?

CWE

Summary

In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.

References

URL

Tags

	https://docs.docker.com/engine/release-notes/	x_refsource_MISC
	http://www.securityfocus.com/bid/109253	vdb-entry, x_refsource_BID
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFFBVE7O73TAVY2BCWXSA2OOSLJVCPXC/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N674WD3OBDPHLWY6EABRHQH5ON6SUJBU/	vendor-advisory, x_refsource_FEDORA
	https://security.netapp.com/advisory/ntap-20190828-0003/	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html	vendor-advisory, x_refsource_SUSE
	https://www.debian.org/security/2019/dsa-4521	vendor-advisory, x_refsource_DEBIAN
	https://seclists.org/bugtraq/2019/Sep/21	mailing-list, x_refsource_BUGTRAQ

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:57:39.278Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.docker.com/engine/release-notes/"
          },
          {
            "name": "109253",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/109253"
          },
          {
            "name": "FEDORA-2019-5b54793a4a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFFBVE7O73TAVY2BCWXSA2OOSLJVCPXC/"
          },
          {
            "name": "FEDORA-2019-4bed83e978",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N674WD3OBDPHLWY6EABRHQH5ON6SUJBU/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190828-0003/"
          },
          {
            "name": "openSUSE-SU-2019:2021",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html"
          },
          {
            "name": "DSA-4521",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4521"
          },
          {
            "name": "20190910 [SECURITY] [DSA 4521-1] docker.io security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Sep/21"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-09-10T17:06:14",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.docker.com/engine/release-notes/"
        },
        {
          "name": "109253",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/109253"
        },
        {
          "name": "FEDORA-2019-5b54793a4a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFFBVE7O73TAVY2BCWXSA2OOSLJVCPXC/"
        },
        {
          "name": "FEDORA-2019-4bed83e978",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N674WD3OBDPHLWY6EABRHQH5ON6SUJBU/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190828-0003/"
        },
        {
          "name": "openSUSE-SU-2019:2021",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html"
        },
        {
          "name": "DSA-4521",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4521"
        },
        {
          "name": "20190910 [SECURITY] [DSA 4521-1] docker.io security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Sep/21"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-13509",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://docs.docker.com/engine/release-notes/",
              "refsource": "MISC",
              "url": "https://docs.docker.com/engine/release-notes/"
            },
            {
              "name": "109253",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/109253"
            },
            {
              "name": "FEDORA-2019-5b54793a4a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFFBVE7O73TAVY2BCWXSA2OOSLJVCPXC/"
            },
            {
              "name": "FEDORA-2019-4bed83e978",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N674WD3OBDPHLWY6EABRHQH5ON6SUJBU/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190828-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190828-0003/"
            },
            {
              "name": "openSUSE-SU-2019:2021",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html"
            },
            {
              "name": "DSA-4521",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4521"
            },
            {
              "name": "20190910 [SECURITY] [DSA 4521-1] docker.io security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Sep/21"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-13509",
    "datePublished": "2019-07-18T15:34:59",
    "dateReserved": "2019-07-11T00:00:00",
    "dateUpdated": "2024-08-04T23:57:39.278Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-41089 (GCVE-0-2021-41089)

Vulnerability from cvelistv5

Published

2021-10-04 20:20

Modified

2024-08-04 02:59

Severity ?

2.8 (Low) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

CWE

CWE-281 - Improper Preservation of Permissions

Summary

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.

References

URL

Tags

	https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4	x_refsource_CONFIRM
	https://github.com/moby/moby/commit/bce32e5c93be4caf1a592582155b9cb837fc129a	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/	vendor-advisory, x_refsource_FEDORA
	https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	moby	moby	Version: < 20.10.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T02:59:31.512Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/commit/bce32e5c93be4caf1a592582155b9cb837fc129a"
          },
          {
            "name": "FEDORA-2021-df975338d4",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/"
          },
          {
            "name": "FEDORA-2021-b5a9a481a2",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moby",
          "vendor": "moby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.10.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host\u2019s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-281",
              "description": "CWE-281: Improper Preservation of Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-14T10:06:38",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/commit/bce32e5c93be4caf1a592582155b9cb837fc129a"
        },
        {
          "name": "FEDORA-2021-df975338d4",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/"
        },
        {
          "name": "FEDORA-2021-b5a9a481a2",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
        }
      ],
      "source": {
        "advisory": "GHSA-v994-f8vw-g7j4",
        "discovery": "UNKNOWN"
      },
      "title": "`docker cp` allows unexpected chmod of host files",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-41089",
          "STATE": "PUBLIC",
          "TITLE": "`docker cp` allows unexpected chmod of host files"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "moby",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 20.10.9"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "moby"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host\u2019s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-281: Improper Preservation of Permissions"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4",
              "refsource": "CONFIRM",
              "url": "https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4"
            },
            {
              "name": "https://github.com/moby/moby/commit/bce32e5c93be4caf1a592582155b9cb837fc129a",
              "refsource": "MISC",
              "url": "https://github.com/moby/moby/commit/bce32e5c93be4caf1a592582155b9cb837fc129a"
            },
            {
              "name": "FEDORA-2021-df975338d4",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/"
            },
            {
              "name": "FEDORA-2021-b5a9a481a2",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-v994-f8vw-g7j4",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-41089",
    "datePublished": "2021-10-04T20:20:15",
    "dateReserved": "2021-09-15T00:00:00",
    "dateUpdated": "2024-08-04T02:59:31.512Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-6408 (GCVE-0-2014-6408)

Vulnerability from cvelistv5

Published

2014-12-12 15:00

Modified

2024-08-06 12:17

Severity ?

CWE

Summary

Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image.

References

URL

Tags

	http://secunia.com/advisories/60241	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/60171	third-party-advisory, x_refsource_SECUNIA
	https://docs.docker.com/v1.3/release-notes/	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html	vendor-advisory, x_refsource_SUSE
	http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html	vendor-advisory, x_refsource_FEDORA
	http://www.openwall.com/lists/oss-security/2014/11/24/5	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T12:17:23.300Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "60241",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60241"
          },
          {
            "name": "60171",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60171"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://docs.docker.com/v1.3/release-notes/"
          },
          {
            "name": "openSUSE-SU-2014:1596",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html"
          },
          {
            "name": "FEDORA-2014-15779",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html"
          },
          {
            "name": "[oss-security] 20141124 Docker 1.3.2 - Security Advisory [24 Nov 2014]",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2014/11/24/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-11-24T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-12-12T13:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "60241",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60241"
        },
        {
          "name": "60171",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60171"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://docs.docker.com/v1.3/release-notes/"
        },
        {
          "name": "openSUSE-SU-2014:1596",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html"
        },
        {
          "name": "FEDORA-2014-15779",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html"
        },
        {
          "name": "[oss-security] 20141124 Docker 1.3.2 - Security Advisory [24 Nov 2014]",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2014/11/24/5"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-6408",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "60241",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60241"
            },
            {
              "name": "60171",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60171"
            },
            {
              "name": "https://docs.docker.com/v1.3/release-notes/",
              "refsource": "CONFIRM",
              "url": "https://docs.docker.com/v1.3/release-notes/"
            },
            {
              "name": "openSUSE-SU-2014:1596",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html"
            },
            {
              "name": "FEDORA-2014-15779",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html"
            },
            {
              "name": "[oss-security] 20141124 Docker 1.3.2 - Security Advisory [24 Nov 2014]",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2014/11/24/5"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-6408",
    "datePublished": "2014-12-12T15:00:00",
    "dateReserved": "2014-09-15T00:00:00",
    "dateUpdated": "2024-08-06T12:17:23.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8867 (GCVE-0-2016-8867)

Vulnerability from cvelistv5

Published

2016-10-28 15:00

Modified

2024-08-06 02:35

Severity ?

CWE

Summary

Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.

References

URL

Tags

	https://www.docker.com/docker-cve-database	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/94228	vdb-entry, x_refsource_BID
	http://www.securitytracker.com/id/1037203	vdb-entry, x_refsource_SECTRACK

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:35:02.197Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.docker.com/docker-cve-database"
          },
          {
            "name": "94228",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94228"
          },
          {
            "name": "1037203",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037203"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-10-28T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-27T09:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.docker.com/docker-cve-database"
        },
        {
          "name": "94228",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94228"
        },
        {
          "name": "1037203",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037203"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-8867",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.docker.com/docker-cve-database",
              "refsource": "CONFIRM",
              "url": "https://www.docker.com/docker-cve-database"
            },
            {
              "name": "94228",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94228"
            },
            {
              "name": "1037203",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037203"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-8867",
    "datePublished": "2016-10-28T15:00:00",
    "dateReserved": "2016-10-21T00:00:00",
    "dateUpdated": "2024-08-06T02:35:02.197Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-23651 (GCVE-0-2024-23651)

Vulnerability from cvelistv5

Published

2024-01-31 21:49

Modified

2025-05-29 15:03

Severity ?

8.7 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Summary

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container. The issue has been fixed in v0.12.5. Workarounds include, avoiding using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with --mount=type=cache,source=... options.

References

URL

Tags

	https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv	x_refsource_CONFIRM
	https://github.com/moby/buildkit/pull/4604	x_refsource_MISC
	https://github.com/moby/buildkit/releases/tag/v0.12.5	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	moby	buildkit	Version: < 0.12.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:06:25.341Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv"
          },
          {
            "name": "https://github.com/moby/buildkit/pull/4604",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/buildkit/pull/4604"
          },
          {
            "name": "https://github.com/moby/buildkit/releases/tag/v0.12.5",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-23651",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T15:46:26.378151Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-29T15:03:12.436Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "buildkit",
          "vendor": "moby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.12.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container. The issue has been fixed in v0.12.5. Workarounds include, avoiding using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with --mount=type=cache,source=... options.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-31T22:00:36.755Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv"
        },
        {
          "name": "https://github.com/moby/buildkit/pull/4604",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/buildkit/pull/4604"
        },
        {
          "name": "https://github.com/moby/buildkit/releases/tag/v0.12.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
        }
      ],
      "source": {
        "advisory": "GHSA-m3r6-h7wv-7xxv",
        "discovery": "UNKNOWN"
      },
      "title": "BuildKit possible race condition with accessing subpaths from cache mounts"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-23651",
    "datePublished": "2024-01-31T21:49:18.041Z",
    "dateReserved": "2024-01-19T00:18:53.234Z",
    "dateUpdated": "2025-05-29T15:03:12.436Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-3631 (GCVE-0-2015-3631)

Vulnerability from cvelistv5

Published

2015-05-18 15:00

Modified

2024-08-06 05:47

Severity ?

CWE

Summary

Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.

References

URL

Tags

	https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ	x_refsource_CONFIRM
	http://seclists.org/fulldisclosure/2015/May/28	mailing-list, x_refsource_FULLDISC
	http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html	vendor-advisory, x_refsource_SUSE
	http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:47:57.906Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ"
          },
          {
            "name": "20150508 Docker 1.6.1 - Security Advisory [150507]",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2015/May/28"
          },
          {
            "name": "openSUSE-SU-2015:0905",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-05-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-30T15:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ"
        },
        {
          "name": "20150508 Docker 1.6.1 - Security Advisory [150507]",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2015/May/28"
        },
        {
          "name": "openSUSE-SU-2015:0905",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-3631",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/forum/#!searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ"
            },
            {
              "name": "20150508 Docker 1.6.1 - Security Advisory [150507]",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2015/May/28"
            },
            {
              "name": "openSUSE-SU-2015:0905",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-3631",
    "datePublished": "2015-05-18T15:00:00",
    "dateReserved": "2015-05-01T00:00:00",
    "dateUpdated": "2024-08-06T05:47:57.906Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-9357 (GCVE-0-2014-9357)

Vulnerability from cvelistv5

Published

2014-12-16 18:00

Modified

2024-08-06 13:40

Severity ?

CWE

Summary

Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.

References

URL

Tags

	https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ	x_refsource_CONFIRM
	http://www.securityfocus.com/archive/1/534215/100/0/threaded	mailing-list, x_refsource_BUGTRAQ

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:40:25.038Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ"
          },
          {
            "name": "20141212 Docker 1.3.3 - Security Advisory [11 Dec 2014]",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/534215/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-12-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ"
        },
        {
          "name": "20141212 Docker 1.3.3 - Security Advisory [11 Dec 2014]",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/534215/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-9357",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/forum/#!msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ"
            },
            {
              "name": "20141212 Docker 1.3.3 - Security Advisory [11 Dec 2014]",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/534215/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-9357",
    "datePublished": "2014-12-16T18:00:00",
    "dateReserved": "2014-12-09T00:00:00",
    "dateUpdated": "2024-08-06T13:40:25.038Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-8694 (GCVE-0-2020-8694)

Vulnerability from cvelistv5

Published

2020-11-12 18:03

Modified

2024-08-04 10:03

Severity ?

CWE

information disclosure

Summary

Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

References

URL

Tags

	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html	mailing-list, x_refsource_MLIST
	https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	Intel(R) Processors	Version: See references

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:03:46.276Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389"
          },
          {
            "name": "[debian-lts-announce] 20201210 [SECURITY] [DLA 2483-1] linux-4.19 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html"
          },
          {
            "name": "[debian-lts-announce] 20201218 [SECURITY] [DLA 2494-1] linux security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Intel(R) Processors",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "See references"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "information disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-11T12:06:30",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389"
        },
        {
          "name": "[debian-lts-announce] 20201210 [SECURITY] [DLA 2483-1] linux-4.19 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html"
        },
        {
          "name": "[debian-lts-announce] 20201218 [SECURITY] [DLA 2494-1] linux security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2020-8694",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Intel(R) Processors",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "See references"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "information disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389",
              "refsource": "MISC",
              "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389"
            },
            {
              "name": "[debian-lts-announce] 20201210 [SECURITY] [DLA 2483-1] linux-4.19 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html"
            },
            {
              "name": "[debian-lts-announce] 20201218 [SECURITY] [DLA 2494-1] linux security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2020-8694",
    "datePublished": "2020-11-12T18:03:34",
    "dateReserved": "2020-02-06T00:00:00",
    "dateUpdated": "2024-08-04T10:03:46.276Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-3697 (GCVE-0-2016-3697)

Vulnerability from cvelistv5

Published

2016-06-01 20:00

Modified

2024-08-06 00:03

Severity ?

CWE

Summary

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.

References

URL

Tags

	http://rhn.redhat.com/errata/RHSA-2016-1034.html	vendor-advisory, x_refsource_REDHAT
	https://github.com/opencontainers/runc/releases/tag/v0.1.0	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-updates/2016-05/msg00111.html	vendor-advisory, x_refsource_SUSE
	https://github.com/docker/docker/issues/21436	x_refsource_CONFIRM
	https://github.com/opencontainers/runc/pull/708	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2016-2634.html	vendor-advisory, x_refsource_REDHAT
	https://github.com/opencontainers/runc/commit/69af385de62ea68e2e608335cffbb0f4aa3db091	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201612-28	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T00:03:34.441Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2016:1034",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1034.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/opencontainers/runc/releases/tag/v0.1.0"
          },
          {
            "name": "openSUSE-SU-2016:1417",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2016-05/msg00111.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/docker/docker/issues/21436"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/opencontainers/runc/pull/708"
          },
          {
            "name": "RHSA-2016:2634",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2634.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/opencontainers/runc/commit/69af385de62ea68e2e608335cffbb0f4aa3db091"
          },
          {
            "name": "GLSA-201612-28",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201612-28"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-03-23T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2016:1034",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1034.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/opencontainers/runc/releases/tag/v0.1.0"
        },
        {
          "name": "openSUSE-SU-2016:1417",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2016-05/msg00111.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/docker/docker/issues/21436"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/opencontainers/runc/pull/708"
        },
        {
          "name": "RHSA-2016:2634",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2634.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/opencontainers/runc/commit/69af385de62ea68e2e608335cffbb0f4aa3db091"
        },
        {
          "name": "GLSA-201612-28",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201612-28"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-3697",
    "datePublished": "2016-06-01T20:00:00",
    "dateReserved": "2016-03-30T00:00:00",
    "dateUpdated": "2024-08-06T00:03:34.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-16874 (GCVE-0-2018-16874)

Vulnerability from cvelistv5

Published

2018-12-14 14:00

Modified

2024-08-05 10:32

Severity ?

6.8 (Medium) - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-20

Summary

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

References

URL

Tags

	https://security.gentoo.org/glsa/201812-09	vendor-advisory, x_refsource_GENTOO
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16874	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/106228	vdb-entry, x_refsource_BID
	https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html	vendor-advisory, x_refsource_SUSE
	https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	[UNKNOWN]	golang	Version: 1.10.6 Version: 1.11.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:32:54.222Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "GLSA-201812-09",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201812-09"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16874"
          },
          {
            "name": "106228",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106228"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0"
          },
          {
            "name": "openSUSE-SU-2019:1079",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html"
          },
          {
            "name": "openSUSE-SU-2019:1444",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html"
          },
          {
            "name": "openSUSE-SU-2019:1499",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html"
          },
          {
            "name": "openSUSE-SU-2019:1506",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html"
          },
          {
            "name": "openSUSE-SU-2019:1703",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html"
          },
          {
            "name": "openSUSE-SU-2020:0554",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html"
          },
          {
            "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
          },
          {
            "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "golang",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "1.10.6"
            },
            {
              "status": "affected",
              "version": "1.11.3"
            }
          ]
        }
      ],
      "datePublic": "2018-12-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both \u0027{\u0027 and \u0027}\u0027 characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-13T20:06:29",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "GLSA-201812-09",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201812-09"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16874"
        },
        {
          "name": "106228",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106228"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0"
        },
        {
          "name": "openSUSE-SU-2019:1079",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html"
        },
        {
          "name": "openSUSE-SU-2019:1444",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html"
        },
        {
          "name": "openSUSE-SU-2019:1499",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html"
        },
        {
          "name": "openSUSE-SU-2019:1506",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html"
        },
        {
          "name": "openSUSE-SU-2019:1703",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html"
        },
        {
          "name": "openSUSE-SU-2020:0554",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html"
        },
        {
          "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
        },
        {
          "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-16874",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "golang",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.10.6"
                          },
                          {
                            "version_value": "1.11.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "[UNKNOWN]"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Go before 1.10.6 and 1.11.x before 1.11.3, the \"go get\" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both \u0027{\u0027 and \u0027}\u0027 characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "6.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "GLSA-201812-09",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201812-09"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16874",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16874"
            },
            {
              "name": "106228",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106228"
            },
            {
              "name": "https://groups.google.com/forum/?pli=1#!topic/golang-announce/Kw31K8G7Fi0",
              "refsource": "MISC",
              "url": "https://groups.google.com/forum/?pli=1#!topic/golang-announce/Kw31K8G7Fi0"
            },
            {
              "name": "openSUSE-SU-2019:1079",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html"
            },
            {
              "name": "openSUSE-SU-2019:1444",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html"
            },
            {
              "name": "openSUSE-SU-2019:1499",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html"
            },
            {
              "name": "openSUSE-SU-2019:1506",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html"
            },
            {
              "name": "openSUSE-SU-2019:1703",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html"
            },
            {
              "name": "openSUSE-SU-2020:0554",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html"
            },
            {
              "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html"
            },
            {
              "name": "[debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-16874",
    "datePublished": "2018-12-14T14:00:00",
    "dateReserved": "2018-09-11T00:00:00",
    "dateUpdated": "2024-08-05T10:32:54.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-28842 (GCVE-0-2023-28842)

Vulnerability from cvelistv5

Published

2023-04-04 21:07

Modified

2025-02-13 16:48

Severity ?

6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

CWE

CWE-420 - Unprotected Alternate Channel
CWE-636 - Not Failing Securely ('Failing Open')

Summary

Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. The `overlay` driver dynamically and lazily defines the kernel configuration for the VXLAN network on each node as containers are attached and detached. Routes and encryption parameters are only defined for destination nodes that participate in the network. The iptables rules that prevent encrypted overlay networks from accepting unencrypted packets are not created until a peer is available with which to communicate. Encrypted overlay networks silently accept cleartext VXLAN datagrams that are tagged with the VNI of an encrypted overlay network. As a result, it is possible to inject arbitrary Ethernet frames into the encrypted overlay network by encapsulating them in VXLAN datagrams. The implications of this can be quite dire, and GHSA-vwm3-crmr-xfxw should be referenced for a deeper exploration. Patches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some workarounds are available. In multi-node clusters, deploy a global ‘pause’ container for each encrypted overlay network, on every node. For a single-node cluster, do not use overlay networks of any sort. Bridge networks provide the same connectivity on a single node and have no multi-node features. The Swarm ingress feature is implemented using an overlay network, but can be disabled by publishing ports in `host` mode instead of `ingress` mode (allowing the use of an external load balancer), and removing the `ingress` network. If encrypted overlay networks are in exclusive use, block UDP port 4789 from traffic that has not been validated by IPSec.

References

URL

Tags

	https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p	x_refsource_CONFIRM
	https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333	x_refsource_MISC
	https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp	x_refsource_MISC
	https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237	x_refsource_MISC
	https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/

Impacted products

	Vendor	Product	Version
	moby	moby	Version: >= 1.12.0, < 20.10.24 Version: >= 23.0.0, < 23.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T13:51:38.540Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p"
          },
          {
            "name": "https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333"
          },
          {
            "name": "https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp"
          },
          {
            "name": "https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237"
          },
          {
            "name": "https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-28842",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-10T21:32:48.323374Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-10T21:32:59.329Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moby",
          "vendor": "moby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.12.0, \u003c 20.10.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 23.0.0, \u003c 23.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*.\n\nSwarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code.\n\nThe `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes.\n\nEncrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption.\n\nWhen setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet\u0027s VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN.\n\nThe `overlay` driver dynamically and lazily defines the kernel configuration for the VXLAN network on each node as containers are attached and detached. Routes and encryption parameters are only defined for destination nodes that participate in the network. The iptables rules that prevent encrypted overlay networks from accepting unencrypted packets are not created until a peer is available with which to communicate.\n\nEncrypted overlay networks silently accept cleartext VXLAN datagrams that are tagged with the VNI of an encrypted overlay network. As a result, it is possible to inject arbitrary Ethernet frames into the encrypted overlay network by encapsulating them in VXLAN datagrams. The implications of this can be quite dire, and GHSA-vwm3-crmr-xfxw should be referenced for a deeper exploration.\n\nPatches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime\u0027s 20.10 releases are numbered differently, users of that platform should update to 20.10.16.\n\nSome workarounds are available. In multi-node clusters, deploy a global \u2018pause\u2019 container for each encrypted overlay network, on every node. For a single-node cluster, do not use overlay networks of any sort. Bridge networks provide the same connectivity on a single node and have no multi-node features. The Swarm ingress feature is implemented using an overlay network, but can be disabled by publishing ports in `host` mode instead of `ingress` mode (allowing the use of an external load balancer), and removing the `ingress` network. If encrypted overlay networks are in exclusive use, block UDP port 4789 from traffic that has not been validated by IPSec."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-420",
              "description": "CWE-420: Unprotected Alternate Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-636",
              "description": "CWE-636: Not Failing Securely (\u0027Failing Open\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-15T20:06:33.396Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p"
        },
        {
          "name": "https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333"
        },
        {
          "name": "https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp"
        },
        {
          "name": "https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237"
        },
        {
          "name": "https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/"
        }
      ],
      "source": {
        "advisory": "GHSA-6wrf-mxfj-pf5p",
        "discovery": "UNKNOWN"
      },
      "title": "moby/moby\u0027s dockerd daemon encrypted overlay network with a single endpoint is unauthenticated"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-28842",
    "datePublished": "2023-04-04T21:07:27.575Z",
    "dateReserved": "2023-03-24T16:25:34.466Z",
    "dateUpdated": "2025-02-13T16:48:55.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-16539 (GCVE-0-2017-16539)

Vulnerability from cvelistv5

Published

2017-11-04 17:00

Modified

2024-08-05 20:27

Severity ?

CWE

Summary

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.

References

URL

Tags

	https://marc.info/?l=linux-scsi&m=150985455801444&w=2	x_refsource_MISC
	https://github.com/moby/moby/pull/35399/commits/a21ecdf3c8a343a7c94e4c4d01b178c87ca7aaa1	x_refsource_MISC
	https://marc.info/?l=linux-scsi&m=150985062200941&w=2	x_refsource_MISC
	https://github.com/moby/moby/pull/35399	x_refsource_MISC
	https://twitter.com/ewindisch/status/926443521820774401	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:27:03.794Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://marc.info/?l=linux-scsi\u0026m=150985455801444\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/pull/35399/commits/a21ecdf3c8a343a7c94e4c4d01b178c87ca7aaa1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://marc.info/?l=linux-scsi\u0026m=150985062200941\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/pull/35399"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://twitter.com/ewindisch/status/926443521820774401"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-11-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a \"scsi remove-single-device\" line to /proc/scsi/scsi, aka SCSI MICDROP."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-05T04:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://marc.info/?l=linux-scsi\u0026m=150985455801444\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/pull/35399/commits/a21ecdf3c8a343a7c94e4c4d01b178c87ca7aaa1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://marc.info/?l=linux-scsi\u0026m=150985062200941\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/pull/35399"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://twitter.com/ewindisch/status/926443521820774401"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-16539",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a \"scsi remove-single-device\" line to /proc/scsi/scsi, aka SCSI MICDROP."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://marc.info/?l=linux-scsi\u0026m=150985455801444\u0026w=2",
              "refsource": "MISC",
              "url": "https://marc.info/?l=linux-scsi\u0026m=150985455801444\u0026w=2"
            },
            {
              "name": "https://github.com/moby/moby/pull/35399/commits/a21ecdf3c8a343a7c94e4c4d01b178c87ca7aaa1",
              "refsource": "MISC",
              "url": "https://github.com/moby/moby/pull/35399/commits/a21ecdf3c8a343a7c94e4c4d01b178c87ca7aaa1"
            },
            {
              "name": "https://marc.info/?l=linux-scsi\u0026m=150985062200941\u0026w=2",
              "refsource": "MISC",
              "url": "https://marc.info/?l=linux-scsi\u0026m=150985062200941\u0026w=2"
            },
            {
              "name": "https://github.com/moby/moby/pull/35399",
              "refsource": "MISC",
              "url": "https://github.com/moby/moby/pull/35399"
            },
            {
              "name": "https://twitter.com/ewindisch/status/926443521820774401",
              "refsource": "MISC",
              "url": "https://twitter.com/ewindisch/status/926443521820774401"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-16539",
    "datePublished": "2017-11-04T17:00:00",
    "dateReserved": "2017-11-04T00:00:00",
    "dateUpdated": "2024-08-05T20:27:03.794Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-13401 (GCVE-0-2020-13401)

Vulnerability from cvelistv5

Published

2020-06-02 13:42

Modified

2024-08-04 12:18

Severity ?

CWE

Summary

An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service.

References

URL

Tags

	https://docs.docker.com/engine/release-notes/	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2020/06/01/5	x_refsource_MISC
	https://github.com/docker/docker-ce/releases/tag/v19.03.11	x_refsource_CONFIRM
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DN4JQAOXBE3XUNK3FD423LHE3K74EMJT/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJZLKRCOJMOGUIJI2AS27BOZS3RBEF3K/	vendor-advisory, x_refsource_FEDORA
	http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00040.html	vendor-advisory, x_refsource_SUSE
	https://www.debian.org/security/2020/dsa-4716	vendor-advisory, x_refsource_DEBIAN
	https://security.netapp.com/advisory/ntap-20200717-0002/	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202008-15	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:18:17.583Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.docker.com/engine/release-notes/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/06/01/5"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/docker/docker-ce/releases/tag/v19.03.11"
          },
          {
            "name": "FEDORA-2020-5ba8c2d9d5",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DN4JQAOXBE3XUNK3FD423LHE3K74EMJT/"
          },
          {
            "name": "FEDORA-2020-6d7deafd81",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJZLKRCOJMOGUIJI2AS27BOZS3RBEF3K/"
          },
          {
            "name": "openSUSE-SU-2020:0846",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00040.html"
          },
          {
            "name": "DSA-4716",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4716"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200717-0002/"
          },
          {
            "name": "GLSA-202008-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202008-15"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-08-26T23:06:19",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.docker.com/engine/release-notes/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/06/01/5"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/docker/docker-ce/releases/tag/v19.03.11"
        },
        {
          "name": "FEDORA-2020-5ba8c2d9d5",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DN4JQAOXBE3XUNK3FD423LHE3K74EMJT/"
        },
        {
          "name": "FEDORA-2020-6d7deafd81",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJZLKRCOJMOGUIJI2AS27BOZS3RBEF3K/"
        },
        {
          "name": "openSUSE-SU-2020:0846",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00040.html"
        },
        {
          "name": "DSA-4716",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4716"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200717-0002/"
        },
        {
          "name": "GLSA-202008-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202008-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-13401",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://docs.docker.com/engine/release-notes/",
              "refsource": "MISC",
              "url": "https://docs.docker.com/engine/release-notes/"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2020/06/01/5",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2020/06/01/5"
            },
            {
              "name": "https://github.com/docker/docker-ce/releases/tag/v19.03.11",
              "refsource": "CONFIRM",
              "url": "https://github.com/docker/docker-ce/releases/tag/v19.03.11"
            },
            {
              "name": "FEDORA-2020-5ba8c2d9d5",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DN4JQAOXBE3XUNK3FD423LHE3K74EMJT/"
            },
            {
              "name": "FEDORA-2020-6d7deafd81",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZLKRCOJMOGUIJI2AS27BOZS3RBEF3K/"
            },
            {
              "name": "openSUSE-SU-2020:0846",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00040.html"
            },
            {
              "name": "DSA-4716",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4716"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200717-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200717-0002/"
            },
            {
              "name": "GLSA-202008-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202008-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-13401",
    "datePublished": "2020-06-02T13:42:09",
    "dateReserved": "2020-05-22T00:00:00",
    "dateUpdated": "2024-08-04T12:18:17.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-21284 (GCVE-0-2021-21284)

Vulnerability from cvelistv5

Published

2021-02-02 17:55

Modified

2024-08-03 18:09

Severity ?

6.8 (Medium) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Summary

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.

References

URL

Tags

	https://docs.docker.com/engine/release-notes/#20103	x_refsource_MISC
	https://github.com/moby/moby/releases/tag/v20.10.3	x_refsource_MISC
	https://github.com/moby/moby/releases/tag/v19.03.15	x_refsource_MISC
	https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc	x_refsource_CONFIRM
	https://github.com/moby/moby/commit/64bd4485b3a66a597c02c95f5776395e540b2c7c	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20210226-0005/	x_refsource_CONFIRM
	https://www.debian.org/security/2021/dsa-4865	vendor-advisory, x_refsource_DEBIAN
	https://security.gentoo.org/glsa/202107-23	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	moby	moby	Version: < 19.03.15 Version: >= 20.0.0, < 20.10.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:09:15.042Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.docker.com/engine/release-notes/#20103"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/releases/tag/v20.10.3"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/releases/tag/v19.03.15"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/commit/64bd4485b3a66a597c02c95f5776395e540b2c7c"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210226-0005/"
          },
          {
            "name": "DSA-4865",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4865"
          },
          {
            "name": "GLSA-202107-23",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202107-23"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moby",
          "vendor": "moby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 19.03.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0, \u003c 20.10.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using \"--userns-remap\", if the root user in the remapped namespace has access to the host filesystem they can modify files under \"/var/lib/docker/\u003cremapping\u003e\" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-07-10T04:06:25",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.docker.com/engine/release-notes/#20103"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/releases/tag/v20.10.3"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/releases/tag/v19.03.15"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/commit/64bd4485b3a66a597c02c95f5776395e540b2c7c"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210226-0005/"
        },
        {
          "name": "DSA-4865",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4865"
        },
        {
          "name": "GLSA-202107-23",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202107-23"
        }
      ],
      "source": {
        "advisory": "GHSA-7452-xqpj-6rpc",
        "discovery": "UNKNOWN"
      },
      "title": "privilege escalation in Moby",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-21284",
          "STATE": "PUBLIC",
          "TITLE": "privilege escalation in Moby"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "moby",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 19.03.15"
                          },
                          {
                            "version_value": "\u003e= 20.0.0, \u003c 20.10.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "moby"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using \"--userns-remap\", if the root user in the remapped namespace has access to the host filesystem they can modify files under \"/var/lib/docker/\u003cremapping\u003e\" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://docs.docker.com/engine/release-notes/#20103",
              "refsource": "MISC",
              "url": "https://docs.docker.com/engine/release-notes/#20103"
            },
            {
              "name": "https://github.com/moby/moby/releases/tag/v20.10.3",
              "refsource": "MISC",
              "url": "https://github.com/moby/moby/releases/tag/v20.10.3"
            },
            {
              "name": "https://github.com/moby/moby/releases/tag/v19.03.15",
              "refsource": "MISC",
              "url": "https://github.com/moby/moby/releases/tag/v19.03.15"
            },
            {
              "name": "https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc",
              "refsource": "CONFIRM",
              "url": "https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc"
            },
            {
              "name": "https://github.com/moby/moby/commit/64bd4485b3a66a597c02c95f5776395e540b2c7c",
              "refsource": "MISC",
              "url": "https://github.com/moby/moby/commit/64bd4485b3a66a597c02c95f5776395e540b2c7c"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210226-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210226-0005/"
            },
            {
              "name": "DSA-4865",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4865"
            },
            {
              "name": "GLSA-202107-23",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202107-23"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-7452-xqpj-6rpc",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-21284",
    "datePublished": "2021-02-02T17:55:22",
    "dateReserved": "2020-12-22T00:00:00",
    "dateUpdated": "2024-08-03T18:09:15.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-8179 (GCVE-0-2014-8179)

Vulnerability from cvelistv5

Published

2019-12-04 15:10

Modified

2024-08-06 13:10

Severity ?

CWE

Other

Summary

Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.

References

URL

Tags

	http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html	x_refsource_MISC
	https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ	x_refsource_MISC
	https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12	x_refsource_MISC
	https://blog.docker.com/2015/10/security-release-docker-1-8-3-1-6-2-cs7/	x_refsource_MISC
	https://www.docker.com/legal/docker-cve-database	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

Docker

Docker Engine

Version: before 1.8.3

Docker

CS Docker Engine

Version: before 1.6.2-CS7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:10:51.252Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.docker.com/2015/10/security-release-docker-1-8-3-1-6-2-cs7/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.docker.com/legal/docker-cve-database"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Docker Engine",
          "vendor": "Docker",
          "versions": [
            {
              "status": "affected",
              "version": "before 1.8.3"
            }
          ]
        },
        {
          "product": "CS Docker Engine",
          "vendor": "Docker",
          "versions": [
            {
              "status": "affected",
              "version": "before 1.6.2-CS7"
            }
          ]
        }
      ],
      "datePublic": "2015-10-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Other",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-12-04T15:10:35",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.docker.com/2015/10/security-release-docker-1-8-3-1-6-2-cs7/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.docker.com/legal/docker-cve-database"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-8179",
    "datePublished": "2019-12-04T15:10:35",
    "dateReserved": "2014-10-10T00:00:00",
    "dateUpdated": "2024-08-06T13:10:51.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-41190 (GCVE-0-2021-41190)

Vulnerability from cvelistv5

Published

2021-11-17 19:20

Modified

2024-08-04 03:08

Severity ?

3.0 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Summary

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.

References

URL

Tags

	https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m	x_refsource_CONFIRM
	https://github.com/opencontainers/distribution-spec/commit/ac28cac0557bcd3084714ab09f9f2356fe504923	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2021/11/19/10	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RRFNTMFYKOTRKD37F5ANMCIO3GGJML/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DX63GRWFEI5RVMYV6XLMCG4OHPWZML27/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SQBCYJUIM5GVCMFUPRWKRZNXMMI5EFA4/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4OJ764CKKCWCVONHD4YXTGR7HZ7LRUV/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TUZNDAH2B26VPBK342UC3BHZNLBUXGX/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RZTO6N55WHKHIZI4IMLY2QFBPMVTAERM/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4334HT7AZPLWNYHW4ARU6JBUF3VZJPZN/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIGVQWOA5XXCQXEOOKZX4CDAGLBDRPRX/	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	opencontainers	distribution-spec	Version: < 1.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:08:31.262Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/opencontainers/distribution-spec/commit/ac28cac0557bcd3084714ab09f9f2356fe504923"
          },
          {
            "name": "[oss-security] 20211119 CVE-2021-41190 OCI distribution and image spec: \"content-type\" confusion",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/11/19/10"
          },
          {
            "name": "FEDORA-2021-d250fc2622",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RRFNTMFYKOTRKD37F5ANMCIO3GGJML/"
          },
          {
            "name": "FEDORA-2021-6dc68dbe4d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DX63GRWFEI5RVMYV6XLMCG4OHPWZML27/"
          },
          {
            "name": "FEDORA-2021-79ba5abef6",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SQBCYJUIM5GVCMFUPRWKRZNXMMI5EFA4/"
          },
          {
            "name": "FEDORA-2021-eb2742b148",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4OJ764CKKCWCVONHD4YXTGR7HZ7LRUV/"
          },
          {
            "name": "FEDORA-2021-3dda301691",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TUZNDAH2B26VPBK342UC3BHZNLBUXGX/"
          },
          {
            "name": "FEDORA-2021-aacef7fa15",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RZTO6N55WHKHIZI4IMLY2QFBPMVTAERM/"
          },
          {
            "name": "FEDORA-2021-62352983b4",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4334HT7AZPLWNYHW4ARU6JBUF3VZJPZN/"
          },
          {
            "name": "FEDORA-2021-6789ed60f2",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIGVQWOA5XXCQXEOOKZX4CDAGLBDRPRX/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "distribution-spec",
          "vendor": "opencontainers",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both \u201cmanifests\u201d and \u201clayers\u201d fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both \u201cmanifests\u201d and \u201clayers\u201d fields or \u201cmanifests\u201d and \u201cconfig\u201d fields if they are unable to update to version 1.0.1 of the spec."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-10T02:06:12",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opencontainers/distribution-spec/commit/ac28cac0557bcd3084714ab09f9f2356fe504923"
        },
        {
          "name": "[oss-security] 20211119 CVE-2021-41190 OCI distribution and image spec: \"content-type\" confusion",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/11/19/10"
        },
        {
          "name": "FEDORA-2021-d250fc2622",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RRFNTMFYKOTRKD37F5ANMCIO3GGJML/"
        },
        {
          "name": "FEDORA-2021-6dc68dbe4d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DX63GRWFEI5RVMYV6XLMCG4OHPWZML27/"
        },
        {
          "name": "FEDORA-2021-79ba5abef6",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SQBCYJUIM5GVCMFUPRWKRZNXMMI5EFA4/"
        },
        {
          "name": "FEDORA-2021-eb2742b148",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4OJ764CKKCWCVONHD4YXTGR7HZ7LRUV/"
        },
        {
          "name": "FEDORA-2021-3dda301691",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TUZNDAH2B26VPBK342UC3BHZNLBUXGX/"
        },
        {
          "name": "FEDORA-2021-aacef7fa15",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RZTO6N55WHKHIZI4IMLY2QFBPMVTAERM/"
        },
        {
          "name": "FEDORA-2021-62352983b4",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4334HT7AZPLWNYHW4ARU6JBUF3VZJPZN/"
        },
        {
          "name": "FEDORA-2021-6789ed60f2",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIGVQWOA5XXCQXEOOKZX4CDAGLBDRPRX/"
        }
      ],
      "source": {
        "advisory": "GHSA-mc8v-mgrf-8f4m",
        "discovery": "UNKNOWN"
      },
      "title": "Clarify Content-Type handling in OCI spec",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-41190",
          "STATE": "PUBLIC",
          "TITLE": "Clarify Content-Type handling in OCI spec"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "distribution-spec",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "opencontainers"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both \u201cmanifests\u201d and \u201clayers\u201d fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both \u201cmanifests\u201d and \u201clayers\u201d fields or \u201cmanifests\u201d and \u201cconfig\u201d fields if they are unable to update to version 1.0.1 of the spec."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m",
              "refsource": "CONFIRM",
              "url": "https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m"
            },
            {
              "name": "https://github.com/opencontainers/distribution-spec/commit/ac28cac0557bcd3084714ab09f9f2356fe504923",
              "refsource": "MISC",
              "url": "https://github.com/opencontainers/distribution-spec/commit/ac28cac0557bcd3084714ab09f9f2356fe504923"
            },
            {
              "name": "[oss-security] 20211119 CVE-2021-41190 OCI distribution and image spec: \"content-type\" confusion",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/11/19/10"
            },
            {
              "name": "FEDORA-2021-d250fc2622",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RRFNTMFYKOTRKD37F5ANMCIO3GGJML/"
            },
            {
              "name": "FEDORA-2021-6dc68dbe4d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DX63GRWFEI5RVMYV6XLMCG4OHPWZML27/"
            },
            {
              "name": "FEDORA-2021-79ba5abef6",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SQBCYJUIM5GVCMFUPRWKRZNXMMI5EFA4/"
            },
            {
              "name": "FEDORA-2021-eb2742b148",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T4OJ764CKKCWCVONHD4YXTGR7HZ7LRUV/"
            },
            {
              "name": "FEDORA-2021-3dda301691",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TUZNDAH2B26VPBK342UC3BHZNLBUXGX/"
            },
            {
              "name": "FEDORA-2021-aacef7fa15",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RZTO6N55WHKHIZI4IMLY2QFBPMVTAERM/"
            },
            {
              "name": "FEDORA-2021-62352983b4",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4334HT7AZPLWNYHW4ARU6JBUF3VZJPZN/"
            },
            {
              "name": "FEDORA-2021-6789ed60f2",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YIGVQWOA5XXCQXEOOKZX4CDAGLBDRPRX/"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-mc8v-mgrf-8f4m",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-41190",
    "datePublished": "2021-11-17T19:20:11",
    "dateReserved": "2021-09-15T00:00:00",
    "dateUpdated": "2024-08-04T03:08:31.262Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-8178 (GCVE-0-2014-8178)

Vulnerability from cvelistv5

Published

2019-12-04 15:05

Modified

2024-08-06 13:10

Severity ?

CWE

Other

Summary

Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.

References

URL

Tags

	http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html	x_refsource_MISC
	https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ	x_refsource_MISC
	https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12	x_refsource_MISC
	https://www.docker.com/legal/docker-cve-database	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

Docker

Docker Engine

Version: before 1.8.3

Docker

CS Docker Engine

Version: before 1.6.2-CS7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:10:51.117Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.docker.com/legal/docker-cve-database"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Docker Engine",
          "vendor": "Docker",
          "versions": [
            {
              "status": "affected",
              "version": "before 1.8.3"
            }
          ]
        },
        {
          "product": "CS Docker Engine",
          "vendor": "Docker",
          "versions": [
            {
              "status": "affected",
              "version": "before 1.6.2-CS7"
            }
          ]
        }
      ],
      "datePublic": "2015-10-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Other",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-12-04T15:05:02",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.docker.com/legal/docker-cve-database"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-8178",
    "datePublished": "2019-12-04T15:05:02",
    "dateReserved": "2014-10-10T00:00:00",
    "dateUpdated": "2024-08-06T13:10:51.117Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-10892 (GCVE-0-2018-10892)

Vulnerability from cvelistv5

Published

2018-07-06 16:00

Modified

2024-08-05 07:54

Severity ?

6.3 (Medium) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

CWE

CWE-250

Summary

The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.

References

URL

Tags

	https://github.com/moby/moby/pull/37404	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:2729	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:2482	vendor-advisory, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10892	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html	vendor-advisory, x_refsource_SUSE
	https://access.redhat.com/errata/RHBA-2018:2796	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	[UNKNOWN]	docker	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:54:34.913Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/pull/37404"
          },
          {
            "name": "RHSA-2018:2729",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2729"
          },
          {
            "name": "RHSA-2018:2482",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2482"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10892"
          },
          {
            "name": "openSUSE-SU-2019:2021",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html"
          },
          {
            "name": "RHBA-2018:2796",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHBA-2018:2796"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "docker",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-07-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host\u0027s hardware like enabling/disabling bluetooth or turning up/down keyboard brightness."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-09-20T07:06:08",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moby/moby/pull/37404"
        },
        {
          "name": "RHSA-2018:2729",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2729"
        },
        {
          "name": "RHSA-2018:2482",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2482"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10892"
        },
        {
          "name": "openSUSE-SU-2019:2021",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html"
        },
        {
          "name": "RHBA-2018:2796",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHBA-2018:2796"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-10892",
    "datePublished": "2018-07-06T16:00:00",
    "dateReserved": "2018-05-09T00:00:00",
    "dateUpdated": "2024-08-05T07:54:34.913Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-23652 (GCVE-0-2024-23652)

Vulnerability from cvelistv5

Published

2024-01-31 21:57

Modified

2025-06-17 21:29

Severity ?

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Summary

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.

References

URL

Tags

	https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8	x_refsource_CONFIRM
	https://github.com/moby/buildkit/pull/4603	x_refsource_MISC
	https://github.com/moby/buildkit/releases/tag/v0.12.5	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	moby	buildkit	Version: < 0.12.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:06:25.358Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8"
          },
          {
            "name": "https://github.com/moby/buildkit/pull/4603",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/buildkit/pull/4603"
          },
          {
            "name": "https://github.com/moby/buildkit/releases/tag/v0.12.5",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-23652",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-01T16:13:41.410911Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T21:29:21.838Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "buildkit",
          "vendor": "moby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.12.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-31T21:57:42.774Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8"
        },
        {
          "name": "https://github.com/moby/buildkit/pull/4603",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/buildkit/pull/4603"
        },
        {
          "name": "https://github.com/moby/buildkit/releases/tag/v0.12.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
        }
      ],
      "source": {
        "advisory": "GHSA-4v98-7qmw-rqr8",
        "discovery": "UNKNOWN"
      },
      "title": "BuildKit possible host system access from mount stub cleaner"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-23652",
    "datePublished": "2024-01-31T21:57:42.774Z",
    "dateReserved": "2024-01-19T00:18:53.234Z",
    "dateUpdated": "2025-06-17T21:29:21.838Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-16875 (GCVE-0-2018-16875)

Vulnerability from cvelistv5

Published

2018-12-14 14:00

Modified

2024-08-05 10:32

Severity ?

5.9 (Medium) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-20

Summary

The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.

References

URL

Tags

	http://www.securityfocus.com/bid/106230	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201812-09	vendor-advisory, x_refsource_GENTOO
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16875	x_refsource_CONFIRM
	https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	[UNKNOWN]	golang	Version: 1.10.6 Version: 1.11.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:32:54.282Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "106230",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106230"
          },
          {
            "name": "GLSA-201812-09",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201812-09"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16875"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0"
          },
          {
            "name": "openSUSE-SU-2019:1079",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html"
          },
          {
            "name": "openSUSE-SU-2019:1444",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html"
          },
          {
            "name": "openSUSE-SU-2019:1499",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html"
          },
          {
            "name": "openSUSE-SU-2019:1506",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html"
          },
          {
            "name": "openSUSE-SU-2019:1703",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "golang",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "1.10.6"
            },
            {
              "status": "affected",
              "version": "1.11.3"
            }
          ]
        }
      ],
      "datePublic": "2018-12-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-07-14T11:06:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "106230",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106230"
        },
        {
          "name": "GLSA-201812-09",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201812-09"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16875"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0"
        },
        {
          "name": "openSUSE-SU-2019:1079",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html"
        },
        {
          "name": "openSUSE-SU-2019:1444",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html"
        },
        {
          "name": "openSUSE-SU-2019:1499",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html"
        },
        {
          "name": "openSUSE-SU-2019:1506",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html"
        },
        {
          "name": "openSUSE-SU-2019:1703",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-16875",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "golang",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.10.6"
                          },
                          {
                            "version_value": "1.11.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "[UNKNOWN]"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "5.9/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "106230",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106230"
            },
            {
              "name": "GLSA-201812-09",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201812-09"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16875",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16875"
            },
            {
              "name": "https://groups.google.com/forum/?pli=1#!topic/golang-announce/Kw31K8G7Fi0",
              "refsource": "MISC",
              "url": "https://groups.google.com/forum/?pli=1#!topic/golang-announce/Kw31K8G7Fi0"
            },
            {
              "name": "openSUSE-SU-2019:1079",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html"
            },
            {
              "name": "openSUSE-SU-2019:1444",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html"
            },
            {
              "name": "openSUSE-SU-2019:1499",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html"
            },
            {
              "name": "openSUSE-SU-2019:1506",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html"
            },
            {
              "name": "openSUSE-SU-2019:1703",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00010.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-16875",
    "datePublished": "2018-12-14T14:00:00",
    "dateReserved": "2018-09-11T00:00:00",
    "dateUpdated": "2024-08-05T10:32:54.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-14992 (GCVE-0-2017-14992)

Vulnerability from cvelistv5

Published

2017-11-01 17:00

Modified

2024-08-05 19:42

Severity ?

CWE

Summary

Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.

References

URL

Tags

	https://blog.cloudpassage.com/2017/10/13/discovering-docker-cve-2017-14992/	x_refsource_MISC
	https://github.com/moby/moby/issues/35075	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:42:22.303Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.cloudpassage.com/2017/10/13/discovering-docker-cve-2017-14992/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/issues/35075"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-10-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-01T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.cloudpassage.com/2017/10/13/discovering-docker-cve-2017-14992/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moby/moby/issues/35075"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-14992",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://blog.cloudpassage.com/2017/10/13/discovering-docker-cve-2017-14992/",
              "refsource": "MISC",
              "url": "https://blog.cloudpassage.com/2017/10/13/discovering-docker-cve-2017-14992/"
            },
            {
              "name": "https://github.com/moby/moby/issues/35075",
              "refsource": "CONFIRM",
              "url": "https://github.com/moby/moby/issues/35075"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-14992",
    "datePublished": "2017-11-01T17:00:00",
    "dateReserved": "2017-10-03T00:00:00",
    "dateUpdated": "2024-08-05T19:42:22.303Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-14271 (GCVE-0-2019-14271)

Vulnerability from cvelistv5

Published

2019-07-29 17:05

Modified

2024-08-05 00:12

Severity ?

CWE

Summary

In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.

References

URL

Tags

	https://github.com/moby/moby/issues/39449	x_refsource_MISC
	https://docs.docker.com/engine/release-notes/	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20190828-0003/	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html	vendor-advisory, x_refsource_SUSE
	https://www.debian.org/security/2019/dsa-4521	vendor-advisory, x_refsource_DEBIAN
	https://seclists.org/bugtraq/2019/Sep/21	mailing-list, x_refsource_BUGTRAQ

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:12:43.386Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/issues/39449"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://docs.docker.com/engine/release-notes/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190828-0003/"
          },
          {
            "name": "openSUSE-SU-2019:2021",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html"
          },
          {
            "name": "DSA-4521",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4521"
          },
          {
            "name": "20190910 [SECURITY] [DSA 4521-1] docker.io security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Sep/21"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-09-10T17:06:14",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/issues/39449"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://docs.docker.com/engine/release-notes/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190828-0003/"
        },
        {
          "name": "openSUSE-SU-2019:2021",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html"
        },
        {
          "name": "DSA-4521",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4521"
        },
        {
          "name": "20190910 [SECURITY] [DSA 4521-1] docker.io security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Sep/21"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-14271",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/moby/moby/issues/39449",
              "refsource": "MISC",
              "url": "https://github.com/moby/moby/issues/39449"
            },
            {
              "name": "https://docs.docker.com/engine/release-notes/",
              "refsource": "CONFIRM",
              "url": "https://docs.docker.com/engine/release-notes/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190828-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190828-0003/"
            },
            {
              "name": "openSUSE-SU-2019:2021",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html"
            },
            {
              "name": "DSA-4521",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4521"
            },
            {
              "name": "20190910 [SECURITY] [DSA 4521-1] docker.io security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Sep/21"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-14271",
    "datePublished": "2019-07-29T17:05:57",
    "dateReserved": "2019-07-25T00:00:00",
    "dateUpdated": "2024-08-05T00:12:43.386Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-36109 (GCVE-0-2022-36109)

Vulnerability from cvelistv5

Published

2022-09-09 17:20

Modified

2025-04-23 17:12

Severity ?

5.3 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-863 - Incorrect Authorization

Summary

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly.

References

URL

Tags

	https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4	x_refsource_CONFIRM
	https://github.com/moby/moby/commit/de7af816e76a7fd3fbf06bffa6832959289fba32	x_refsource_MISC
	https://github.com/moby/moby/releases/tag/v20.10.18	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7JL2QA3RB732MLJ3RMUXB3IB7AA22YU	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQQ4E3JBXVR3VK5FIZVJ3QS2TAOOXXTQ	x_refsource_MISC
	https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	moby	moby	Version: < 20.10.18

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T09:52:00.643Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/commit/de7af816e76a7fd3fbf06bffa6832959289fba32"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/releases/tag/v20.10.18"
          },
          {
            "name": "FEDORA-2022-b027a13a39",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQQ4E3JBXVR3VK5FIZVJ3QS2TAOOXXTQ/"
          },
          {
            "name": "FEDORA-2022-8298607490",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7JL2QA3RB732MLJ3RMUXB3IB7AA22YU/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-36109",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T14:01:05.658432Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T17:12:31.122Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moby",
          "vendor": "moby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 20.10.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.  This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `\"USER $USERNAME\"` Dockerfile instruction. Instead by calling `ENTRYPOINT [\"su\", \"-\", \"user\"]` the supplementary groups will be set up properly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-17T13:07:54.013Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4"
        },
        {
          "name": "https://github.com/moby/moby/commit/de7af816e76a7fd3fbf06bffa6832959289fba32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/commit/de7af816e76a7fd3fbf06bffa6832959289fba32"
        },
        {
          "name": "https://github.com/moby/moby/releases/tag/v20.10.18",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/releases/tag/v20.10.18"
        },
        {
          "name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7JL2QA3RB732MLJ3RMUXB3IB7AA22YU",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7JL2QA3RB732MLJ3RMUXB3IB7AA22YU"
        },
        {
          "name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQQ4E3JBXVR3VK5FIZVJ3QS2TAOOXXTQ",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQQ4E3JBXVR3VK5FIZVJ3QS2TAOOXXTQ"
        },
        {
          "name": "https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation"
        }
      ],
      "source": {
        "advisory": "GHSA-rc4r-wh2q-q6c4",
        "discovery": "UNKNOWN"
      },
      "title": "Moby vulnerability relating to supplementary group permissions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-36109",
    "datePublished": "2022-09-09T17:20:11.000Z",
    "dateReserved": "2022-07-15T00:00:00.000Z",
    "dateUpdated": "2025-04-23T17:12:31.122Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-9356 (GCVE-0-2014-9356)

Vulnerability from cvelistv5

Published

2019-12-02 17:07

Modified

2024-08-06 13:40

Severity ?

CWE

Summary

Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.

References

URL

Tags

http://www.securityfocus.com/archive/1/archive/1/534215/100/0/threaded

mailing-list, x_refsource_BUGTRAQ

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:40:25.025Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20141212 Docker 1.3.3 - Security Advisory [11 Dec 2014]",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/archive/1/534215/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-12-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-12-02T17:07:40",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20141212 Docker 1.3.3 - Security Advisory [11 Dec 2014]",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/archive/1/534215/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-9356",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20141212 Docker 1.3.3 - Security Advisory [11 Dec 2014]",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/archive/1/534215/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-9356",
    "datePublished": "2019-12-02T17:07:40",
    "dateReserved": "2014-12-09T00:00:00",
    "dateUpdated": "2024-08-06T13:40:25.025Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-43565 (GCVE-0-2021-43565)

Vulnerability from cvelistv5

Published

2022-09-06 17:03

Modified

2024-08-04 04:03

Severity ?

CWE

Summary

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.

References

URL

Tags

	https://groups.google.com/forum/#%21forum/golang-announce	x_refsource_MISC
	https://groups.google.com/g/golang-announce/c/2AR1sKiM-Qs	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T04:03:07.828Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21forum/golang-announce"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/2AR1sKiM-Qs"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-06T17:03:42",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/forum/#%21forum/golang-announce"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/g/golang-announce/c/2AR1sKiM-Qs"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-43565",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/forum/#!forum/golang-announce",
              "refsource": "MISC",
              "url": "https://groups.google.com/forum/#!forum/golang-announce"
            },
            {
              "name": "https://groups.google.com/g/golang-announce/c/2AR1sKiM-Qs",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/g/golang-announce/c/2AR1sKiM-Qs"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-43565",
    "datePublished": "2022-09-06T17:03:42",
    "dateReserved": "2021-11-09T00:00:00",
    "dateUpdated": "2024-08-04T04:03:07.828Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-5277 (GCVE-0-2014-5277)

Vulnerability from cvelistv5

Published

2014-11-17 16:00

Modified

2024-08-06 11:41

Severity ?

CWE

Summary

Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.

References

URL

Tags

	http://lists.opensuse.org/opensuse-updates/2014-11/msg00048.html	vendor-advisory, x_refsource_SUSE
	https://groups.google.com/forum/#%21topic/docker-user/oYm0i3xShJU	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:41:47.966Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "openSUSE-SU-2014:1411",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00048.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/docker-user/oYm0i3xShJU"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-11-17T15:57:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "openSUSE-SU-2014:1411",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00048.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21topic/docker-user/oYm0i3xShJU"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-5277",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "openSUSE-SU-2014:1411",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00048.html"
            },
            {
              "name": "https://groups.google.com/forum/#!topic/docker-user/oYm0i3xShJU",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!topic/docker-user/oYm0i3xShJU"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-5277",
    "datePublished": "2014-11-17T16:00:00",
    "dateReserved": "2014-08-16T00:00:00",
    "dateUpdated": "2024-08-06T11:41:47.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-15664 (GCVE-0-2018-15664)

Vulnerability from cvelistv5

Published

2019-05-23 13:58

Modified

2024-08-05 10:01

Severity ?

CWE

Summary

In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).

References

URL

Tags

	https://bugzilla.suse.com/show_bug.cgi?id=1096726	x_refsource_MISC
	https://github.com/moby/moby/pull/39252	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2019/05/28/1	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/108507	vdb-entry, x_refsource_BID
	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00066.html	vendor-advisory, x_refsource_SUSE
	https://usn.ubuntu.com/4048-1/	vendor-advisory, x_refsource_UBUNTU
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-15664	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2019:1910	vendor-advisory, x_refsource_REDHAT
	http://www.openwall.com/lists/oss-security/2019/08/21/1	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:01:54.533Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1096726"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/moby/moby/pull/39252"
          },
          {
            "name": "[oss-security] 20190528 CVE-2018-15664: docker (all versions) is vulnerable to a symlink-race attack",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2019/05/28/1"
          },
          {
            "name": "108507",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/108507"
          },
          {
            "name": "openSUSE-SU-2019:1621",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00066.html"
          },
          {
            "name": "USN-4048-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4048-1/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-15664"
          },
          {
            "name": "RHSA-2019:1910",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1910"
          },
          {
            "name": "[oss-security] 20190821 RE: CVE-2018-15664: docker (all versions) is vulnerable to a symlink-race attack",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2019/08/21/1"
          },
          {
            "name": "openSUSE-SU-2019:2044",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-05-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In Docker through 18.06.1-ce-rc2, the API endpoints behind the \u0027docker cp\u0027 command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-09-01T23:06:07",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1096726"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/pull/39252"
        },
        {
          "name": "[oss-security] 20190528 CVE-2018-15664: docker (all versions) is vulnerable to a symlink-race attack",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2019/05/28/1"
        },
        {
          "name": "108507",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/108507"
        },
        {
          "name": "openSUSE-SU-2019:1621",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00066.html"
        },
        {
          "name": "USN-4048-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4048-1/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-15664"
        },
        {
          "name": "RHSA-2019:1910",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1910"
        },
        {
          "name": "[oss-security] 20190821 RE: CVE-2018-15664: docker (all versions) is vulnerable to a symlink-race attack",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2019/08/21/1"
        },
        {
          "name": "openSUSE-SU-2019:2044",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-15664",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Docker through 18.06.1-ce-rc2, the API endpoints behind the \u0027docker cp\u0027 command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1096726",
              "refsource": "MISC",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1096726"
            },
            {
              "name": "https://github.com/moby/moby/pull/39252",
              "refsource": "MISC",
              "url": "https://github.com/moby/moby/pull/39252"
            },
            {
              "name": "[oss-security] 20190528 CVE-2018-15664: docker (all versions) is vulnerable to a symlink-race attack",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2019/05/28/1"
            },
            {
              "name": "108507",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/108507"
            },
            {
              "name": "openSUSE-SU-2019:1621",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00066.html"
            },
            {
              "name": "USN-4048-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4048-1/"
            },
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-15664",
              "refsource": "CONFIRM",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-15664"
            },
            {
              "name": "RHSA-2019:1910",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1910"
            },
            {
              "name": "[oss-security] 20190821 RE: CVE-2018-15664: docker (all versions) is vulnerable to a symlink-race attack",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2019/08/21/1"
            },
            {
              "name": "openSUSE-SU-2019:2044",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-15664",
    "datePublished": "2019-05-23T13:58:37",
    "dateReserved": "2018-08-21T00:00:00",
    "dateUpdated": "2024-08-05T10:01:54.533Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-3627 (GCVE-0-2015-3627)

Vulnerability from cvelistv5

Published

2015-05-18 15:00

Modified

2024-08-06 05:47

Severity ?

CWE

Summary

Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.

References

URL

Tags

	https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ	x_refsource_CONFIRM
	http://seclists.org/fulldisclosure/2015/May/28	mailing-list, x_refsource_FULLDISC
	http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html	vendor-advisory, x_refsource_SUSE
	http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:47:57.723Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ"
          },
          {
            "name": "20150508 Docker 1.6.1 - Security Advisory [150507]",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2015/May/28"
          },
          {
            "name": "openSUSE-SU-2015:0905",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-05-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-30T15:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ"
        },
        {
          "name": "20150508 Docker 1.6.1 - Security Advisory [150507]",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2015/May/28"
        },
        {
          "name": "openSUSE-SU-2015:0905",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-3627",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/forum/#!searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ"
            },
            {
              "name": "20150508 Docker 1.6.1 - Security Advisory [150507]",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2015/May/28"
            },
            {
              "name": "openSUSE-SU-2015:0905",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-3627",
    "datePublished": "2015-05-18T15:00:00",
    "dateReserved": "2015-04-30T00:00:00",
    "dateUpdated": "2024-08-06T05:47:57.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-3630 (GCVE-0-2015-3630)

Vulnerability from cvelistv5

Published

2015-05-18 15:00

Modified

2024-08-06 05:47

Severity ?

CWE

Summary

Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.

References

URL

Tags

	https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ	x_refsource_CONFIRM
	http://seclists.org/fulldisclosure/2015/May/28	mailing-list, x_refsource_FULLDISC
	http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html	vendor-advisory, x_refsource_SUSE
	http://www.securityfocus.com/bid/74566	vdb-entry, x_refsource_BID
	http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:47:57.807Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ"
          },
          {
            "name": "20150508 Docker 1.6.1 - Security Advisory [150507]",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2015/May/28"
          },
          {
            "name": "openSUSE-SU-2015:0905",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html"
          },
          {
            "name": "74566",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/74566"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-05-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-30T15:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ"
        },
        {
          "name": "20150508 Docker 1.6.1 - Security Advisory [150507]",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2015/May/28"
        },
        {
          "name": "openSUSE-SU-2015:0905",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html"
        },
        {
          "name": "74566",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/74566"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-3630",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/forum/#!searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ"
            },
            {
              "name": "20150508 Docker 1.6.1 - Security Advisory [150507]",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2015/May/28"
            },
            {
              "name": "openSUSE-SU-2015:0905",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html"
            },
            {
              "name": "74566",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/74566"
            },
            {
              "name": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-3630",
    "datePublished": "2015-05-18T15:00:00",
    "dateReserved": "2015-05-01T00:00:00",
    "dateUpdated": "2024-08-06T05:47:57.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-8695 (GCVE-0-2020-8695)

Vulnerability from cvelistv5

Published

2020-11-12 18:03

Modified

2024-08-04 10:03

Severity ?

CWE

information disclosure

Summary

Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

References

URL

Tags

	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAAGIK5CXKBPGY3R4UR5VO56M7MKLZ43/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AQ24MFBVH3HJW3PNRQBRY4YXKC7GA57W/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEM2FZWVE4FNGYNQU3WCBAWTZRBWDYUR/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GRFC7UAPKAFFH5WX3AMDUBVHLKYQA2NZ/	vendor-advisory, x_refsource_FEDORA
	https://lists.debian.org/debian-lts-announce/2021/02/msg00007.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	Intel(R) Processors	Version: See references

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:03:46.335Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389"
          },
          {
            "name": "FEDORA-2020-14fda1bf85",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAAGIK5CXKBPGY3R4UR5VO56M7MKLZ43/"
          },
          {
            "name": "FEDORA-2020-2c8824c6b1",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AQ24MFBVH3HJW3PNRQBRY4YXKC7GA57W/"
          },
          {
            "name": "FEDORA-2020-d5941ea479",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEM2FZWVE4FNGYNQU3WCBAWTZRBWDYUR/"
          },
          {
            "name": "FEDORA-2020-1afbe7ba2d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GRFC7UAPKAFFH5WX3AMDUBVHLKYQA2NZ/"
          },
          {
            "name": "[debian-lts-announce] 20210205 [SECURITY] [DLA 2546-1] intel-microcode security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Intel(R) Processors",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "See references"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "information disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-02-05T20:06:11",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389"
        },
        {
          "name": "FEDORA-2020-14fda1bf85",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAAGIK5CXKBPGY3R4UR5VO56M7MKLZ43/"
        },
        {
          "name": "FEDORA-2020-2c8824c6b1",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AQ24MFBVH3HJW3PNRQBRY4YXKC7GA57W/"
        },
        {
          "name": "FEDORA-2020-d5941ea479",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEM2FZWVE4FNGYNQU3WCBAWTZRBWDYUR/"
        },
        {
          "name": "FEDORA-2020-1afbe7ba2d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GRFC7UAPKAFFH5WX3AMDUBVHLKYQA2NZ/"
        },
        {
          "name": "[debian-lts-announce] 20210205 [SECURITY] [DLA 2546-1] intel-microcode security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00007.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2020-8695",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Intel(R) Processors",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "See references"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "information disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389",
              "refsource": "MISC",
              "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389"
            },
            {
              "name": "FEDORA-2020-14fda1bf85",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAAGIK5CXKBPGY3R4UR5VO56M7MKLZ43/"
            },
            {
              "name": "FEDORA-2020-2c8824c6b1",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AQ24MFBVH3HJW3PNRQBRY4YXKC7GA57W/"
            },
            {
              "name": "FEDORA-2020-d5941ea479",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEM2FZWVE4FNGYNQU3WCBAWTZRBWDYUR/"
            },
            {
              "name": "FEDORA-2020-1afbe7ba2d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GRFC7UAPKAFFH5WX3AMDUBVHLKYQA2NZ/"
            },
            {
              "name": "[debian-lts-announce] 20210205 [SECURITY] [DLA 2546-1] intel-microcode security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00007.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2020-8695",
    "datePublished": "2020-11-12T18:03:43",
    "dateReserved": "2020-02-06T00:00:00",
    "dateUpdated": "2024-08-04T10:03:46.335Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

opensuse-su-2025:15589-1

Vulnerability from csaf_opensuse

CVE-2018-16873 (GCVE-0-2018-16873)

Vulnerability from cvelistv5

CVE-2023-28841 (GCVE-0-2023-28841)

Vulnerability from cvelistv5

CVE-2015-3629 (GCVE-0-2015-3629)

Vulnerability from cvelistv5

CVE-2014-3499 (GCVE-0-2014-3499)

Vulnerability from cvelistv5

CVE-2014-6407 (GCVE-0-2014-6407)

Vulnerability from cvelistv5

CVE-2020-15257 (GCVE-0-2020-15257)

Vulnerability from cvelistv5

CVE-2021-41092 (GCVE-0-2021-41092)

Vulnerability from cvelistv5

CVE-2016-9962 (GCVE-0-2016-9962)

Vulnerability from cvelistv5

CVE-2022-24769 (GCVE-0-2022-24769)

Vulnerability from cvelistv5

CVE-2018-20699 (GCVE-0-2018-20699)

Vulnerability from cvelistv5

CVE-2020-12912 (GCVE-0-2020-12912)

Vulnerability from cvelistv5

CVE-2014-9358 (GCVE-0-2014-9358)

Vulnerability from cvelistv5

CVE-2023-28840 (GCVE-0-2023-28840)

Vulnerability from cvelistv5

CVE-2019-13509 (GCVE-0-2019-13509)

Vulnerability from cvelistv5

CVE-2021-41089 (GCVE-0-2021-41089)

Vulnerability from cvelistv5

CVE-2014-6408 (GCVE-0-2014-6408)

Vulnerability from cvelistv5

CVE-2016-8867 (GCVE-0-2016-8867)

Vulnerability from cvelistv5

CVE-2024-23651 (GCVE-0-2024-23651)

Vulnerability from cvelistv5

CVE-2015-3631 (GCVE-0-2015-3631)

Vulnerability from cvelistv5

CVE-2014-9357 (GCVE-0-2014-9357)

Vulnerability from cvelistv5

CVE-2020-8694 (GCVE-0-2020-8694)

Vulnerability from cvelistv5

CVE-2016-3697 (GCVE-0-2016-3697)

Vulnerability from cvelistv5

CVE-2018-16874 (GCVE-0-2018-16874)

Vulnerability from cvelistv5

CVE-2023-28842 (GCVE-0-2023-28842)

Vulnerability from cvelistv5

CVE-2017-16539 (GCVE-0-2017-16539)

Vulnerability from cvelistv5

CVE-2020-13401 (GCVE-0-2020-13401)

Vulnerability from cvelistv5

CVE-2021-21284 (GCVE-0-2021-21284)

Vulnerability from cvelistv5

CVE-2014-8179 (GCVE-0-2014-8179)

Vulnerability from cvelistv5

CVE-2021-41190 (GCVE-0-2021-41190)

Vulnerability from cvelistv5

CVE-2014-8178 (GCVE-0-2014-8178)

Vulnerability from cvelistv5

CVE-2018-10892 (GCVE-0-2018-10892)

Vulnerability from cvelistv5

CVE-2024-23652 (GCVE-0-2024-23652)

Vulnerability from cvelistv5

CVE-2018-16875 (GCVE-0-2018-16875)

Vulnerability from cvelistv5

CVE-2017-14992 (GCVE-0-2017-14992)

Vulnerability from cvelistv5

CVE-2019-14271 (GCVE-0-2019-14271)

Vulnerability from cvelistv5

CVE-2022-36109 (GCVE-0-2022-36109)

Vulnerability from cvelistv5

CVE-2014-9356 (GCVE-0-2014-9356)

Vulnerability from cvelistv5

CVE-2021-43565 (GCVE-0-2021-43565)

Vulnerability from cvelistv5

CVE-2014-5277 (GCVE-0-2014-5277)