PT-2018-11289 · Docker · Docker Moby+1

Abergmann · Publicado 2018-09-10 · Atualizado 2024-01-31 · CVE-2018-12608

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Docker Moby versions prior to 17.06.0

Description An issue was discovered where the Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA to authenticate.

Recommendations For versions prior to 17.06.0, update to version 17.06.0 or later to resolve the issue.

Correção

Improper Certificate Validation

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-295

CWE-288

Identificadores relacionados

CVE-2018-12608

GHSA-QRQR-3X5J-2XW9

Produtos afetados

Docker

Docker Moby

Referências · 12

• https://github.com/moby/moby · Nota
• https://github.com/moby/moby/pull/33182 · Correção
• https://github.com/moby/moby/commit/190c6e8cf8b893874a33d83f78307f1bed0bfbcd · Nota
• https://github.com/moby/moby/issues/33173 · Nota
• https://osv.dev/vulnerability/CVE-2018-12608 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-12608 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-12608 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2018-12608 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-12608 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-qrqr-3x5j-2xw9 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-12608 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-12608 · Aviso do Fabricante