PT-2018-18411 · Docker+2 · Docker Compose+2

Publicado 2018-03-11 · Atualizado 2018-04-12 · CVE-2018-8059

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SUSE Portus version 2.3

Description: The issue arises from the Djelibeybi configuration examples for NGINX in SUSE Portus, specifically when these configurations are applied to setups involving Docker Compose. The problem is a Missing SSL Certificate Validation issue, which occurs because the configurations do not utilize any proxy ssl * directives. This oversight can lead to security risks, as it may allow for unvalidated SSL certificates to be used.

Recommendations: For SUSE Portus version 2.3, consider adding the necessary proxy ssl * directives to the NGINX configuration to enable proper SSL certificate validation, especially in setups involving Docker Compose. As a temporary workaround, review and manually validate SSL certificates for all connections until a properly configured version is available.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2018-8059

Produtos afetados

Docker Compose

Nginx

Suse Portus

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/140144 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-8059 · Nota de Segurança
• http://openwall.com/lists/oss-security/2018/03/07/4 · Nota
• https://osv.dev/vulnerability/CVE-2018-8059 · Aviso do Fabricante