PT-2018-11289 · Docker · Docker Moby+1

Abergmann · Published 2018-09-10 · Updated 2024-01-31 · CVE-2018-12608

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Docker Moby versions prior to 17.06.0

Description An issue was discovered where the Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA to authenticate.

Recommendations For versions prior to 17.06.0, update to version 17.06.0 or later to resolve the issue.

Fix

Improper Certificate Validation

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-295

CWE-288

Related Identifiers

CVE-2018-12608

GHSA-QRQR-3X5J-2XW9

Affected Products

Docker

Docker Moby

References · 12

• https://github.com/moby/moby/pull/33182 · Patch
• https://osv.dev/vulnerability/CVE-2018-12608 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-12608 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12608 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-12608 · Security Note
• https://ubuntu.com/security/CVE-2018-12608 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qrqr-3x5j-2xw9 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-12608 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-12608 · Vendor Advisory
• https://github.com/moby/moby · Note
• https://github.com/moby/moby/commit/190c6e8cf8b893874a33d83f78307f1bed0bfbcd · Note
• https://github.com/moby/moby/issues/33173 · Note