Vulnerable Library - github.com/docker/docker-v20.10.9

Moby Project - a collaborative project for the container ecosystem to assemble container-based systems

Dependency Hierarchy:

• github.com/ory/dockertest/v3-v3.8.1 (Root Library)
  • github.com/docker/cli-v20.10.11
    • ❌ github.com/docker/docker-v20.10.9 (Vulnerable Library)

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already. A possible workaround is to ensure the directories have the desired permission (700).

Publish Date: 2020-08-05

URL: CVE-2020-15113

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: etcd-io/etcd@v3.4.9...v3.4.10

Release Date: 2020-07-21

Fix Resolution: 3.4.10, 3.3.23

Vulnerable Library - github.com/docker/docker-v20.10.9

Moby Project - a collaborative project for the container ecosystem to assemble container-based systems

Dependency Hierarchy:

• github.com/ory/dockertest/v3-v3.8.1 (Root Library)
  • github.com/docker/cli-v20.10.11
    • ❌ github.com/docker/docker-v20.10.9 (Vulnerable Library)

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container.

Publish Date: 2020-12-01

URL: CVE-2020-15257

CVSS 3 Score Details (5.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-36xw-fx78-c5r4

Release Date: 2020-12-01

Fix Resolution: v1.3.9,v1.4.3

Vulnerable Libraries - github.com/docker/cli-v20.10.11, github.com/docker/docker-v20.10.9

Found in HEAD commit: 8e4b7b20930ec3011f7ac2504deb58c92e4e8b4f

Found in base branch: main

Vulnerability Details

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

Publish Date: 2021-05-27

URL: CVE-2021-31525

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1958341

Release Date: 2021-05-27

Fix Resolution: golang - v1.15.12,v1.16.4,v1.17.0

Vulnerable Library - github.com/docker/cli-v20.10.11

The Docker CLI

Dependency Hierarchy:

• github.com/ory/dockertest/v3-v3.8.1 (Root Library)
  • ❌ github.com/docker/cli-v20.10.11 (Vulnerable Library)

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

Publish Date: 2020-07-22

URL: CVE-2020-8559

CVSS 3 Score Details (6.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: kubernetes/kubernetes#92914

Release Date: 2020-07-21

Fix Resolution: v1.18.6,v1.17.9,v1.16.13

Vulnerable Library - github.com/docker/docker-v20.10.9

Moby Project - a collaborative project for the container ecosystem to assemble container-based systems

Dependency Hierarchy:

• github.com/ory/dockertest/v3-v3.8.1 (Root Library)
  • github.com/docker/cli-v20.10.11
    • ❌ github.com/docker/docker-v20.10.9 (Vulnerable Library)

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.

Publish Date: 2021-07-19

URL: CVE-2021-32760

CVSS 3 Score Details (6.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: GHSA-c72p-9xmj-rx3w

Release Date: 2021-07-19

Fix Resolution: v1.4.8 ,v1.5.4

Vulnerable Library - github.com/docker/docker-v20.10.9

Moby Project - a collaborative project for the container ecosystem to assemble container-based systems

Dependency Hierarchy:

• github.com/ory/dockertest/v3-v3.8.1 (Root Library)
  • github.com/docker/cli-v20.10.11
    • ❌ github.com/docker/docker-v20.10.9 (Vulnerable Library)

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.

Publish Date: 2020-08-05

URL: CVE-2020-15112

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: etcd-io/etcd@v3.4.9...v3.4.10

Release Date: 2020-08-05

Fix Resolution: 3.4.10, 3.3.23

Vulnerable Library - github.com/docker/docker-v20.10.9

Moby Project - a collaborative project for the container ecosystem to assemble container-based systems

Dependency Hierarchy:

• github.com/ory/dockertest/v3-v3.8.1 (Root Library)
  • github.com/docker/cli-v20.10.11
    • ❌ github.com/docker/docker-v20.10.9 (Vulnerable Library)

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.

Publish Date: 2019-01-12

URL: CVE-2018-20699

CVSS 3 Score Details (4.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: docker/engine#70

Release Date: 2019-01-12

Fix Resolution: v18.09.0

Vulnerable Library - github.com/docker/docker-v20.10.9

Moby Project - a collaborative project for the container ecosystem to assemble container-based systems

Dependency Hierarchy:

• github.com/ory/dockertest/v3-v3.8.1 (Root Library)
  • github.com/docker/cli-v20.10.11
    • ❌ github.com/docker/docker-v20.10.9 (Vulnerable Library)

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

In the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header. Versions of containerd prior to 1.4.12 and 1.5.8 treat the Content-Type header as trusted and deserialize the document according to that header. If the Content-Type header changed between pulls of the same ambiguous document (with the same digest), the document may be interpreted differently, meaning that the digest alone is insufficient to unambiguously identify the content of the image.

Publish Date: 2021-11-18

URL: WS-2021-0427

CVSS 3 Score Details (3.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-5j5w-g665-5m35

Release Date: 2021-11-18

Fix Resolution: solidus_core - 2.11.12, 3.0.3, 3.1.3

Vulnerable Library - github.com/docker/docker-v20.10.9

Moby Project - a collaborative project for the container ecosystem to assemble container-based systems

Dependency Hierarchy:

• github.com/ory/dockertest/v3-v3.8.1 (Root Library)
  • github.com/docker/cli-v20.10.11
    • ❌ github.com/docker/docker-v20.10.9 (Vulnerable Library)

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability. Users unable to update should limit access to the host to trusted users. Update directory permission on container bundles directories.

Publish Date: 2021-10-04

URL: CVE-2021-41103

CVSS 3 Score Details (7.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2h3-6mxw-7mvq

Release Date: 2021-10-04

Fix Resolution: v1.4.11,v1.5.7

Vulnerable Libraries - github.com/docker/cli-v20.10.11, github.com/docker/docker-v20.10.9

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.

Publish Date: 2021-11-17

URL: CVE-2021-41190

CVSS 3 Score Details (5.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-qq97-vm5h-rrhg

Release Date: 2021-11-17

Fix Resolution: v2.8.0

Vulnerable Library - github.com/docker/docker-v20.10.9

Moby Project - a collaborative project for the container ecosystem to assemble container-based systems

Dependency Hierarchy:

• github.com/ory/dockertest/v3-v3.8.1 (Root Library)
  • github.com/docker/cli-v20.10.11
    • ❌ github.com/docker/docker-v20.10.9 (Vulnerable Library)

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

Publish Date: 2020-08-05

URL: CVE-2020-15106

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-15106

Release Date: 2020-08-05

Fix Resolution: v3.3.23;v3.4.10

Vulnerable Library - github.com/docker/docker-v20.10.9

Moby Project - a collaborative project for the container ecosystem to assemble container-based systems

Dependency Hierarchy:

• github.com/ory/dockertest/v3-v3.8.1 (Root Library)
  • github.com/docker/cli-v20.10.11
    • ❌ github.com/docker/docker-v20.10.9 (Vulnerable Library)

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.

Publish Date: 2021-05-27

URL: CVE-2021-30465

CVSS 3 Score Details (8.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-c3xm-pvg7-gh7r

Release Date: 2021-05-27

Fix Resolution: v1.0.0-rc95

Vulnerable Library - github.com/golang/net-6772e930b67bb09bf22262c7378e7d2f67cf59d1

[mirror] Go supplementary network libraries

Dependency Hierarchy:

• github.com/ory/dockertest-v3.7.0 (Root Library)
  • ❌ github.com/golang/net-6772e930b67bb09bf22262c7378e7d2f67cf59d1 (Vulnerable Library)

Found in HEAD commit: 8e4b7b20930ec3011f7ac2504deb58c92e4e8b4f

Found in base branch: main

Vulnerability Details

golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.

Publish Date: 2021-05-26

URL: CVE-2021-33194

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33194

Release Date: 2021-05-26

Fix Resolution: golang.org/x/net - v0.0.0-20210520170846-37e1c6afe023

Vulnerable Libraries - github.com/docker/cli-v20.10.11, github.com/docker/docker-v20.10.9

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.

Publish Date: 2020-12-17

URL: CVE-2020-29652

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1

Release Date: 2020-12-17

Fix Resolution: v0.0.0-20201216223049-8b5274cf687f

Vulnerable Libraries - github.com/docker/cli-v20.10.11, github.com/docker/docker-v20.10.9

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

There's an input validation flaw in golang.org/x/crypto's readCipherPacket() function. An unauthenticated attacker who sends an empty plaintext packet to a program linked with golang.org/x/crypto/ssh could cause a panic, potentially leading to denial of service.

Publish Date: 2021-11-10

URL: CVE-2021-43565

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Vulnerable Libraries - github.com/docker/cli-v20.10.11, github.com/docker/docker-v20.10.9

Found in HEAD commit: 1a5da3c9c85cd51e447da4c7ce6999697be448a9

Found in base branch: main

Vulnerability Details

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric with method label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown method. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the method label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

Publish Date: 2022-02-15

URL: CVE-2022-21698

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-cg3q-j54f-5p7p

Release Date: 2022-02-15

Fix Resolution: v1.11.1

Vulnerable Libraries - github.com/docker/cli-v20.10.11, github.com/docker/docker-v20.10.9

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

Publish Date: 2021-01-11

URL: CVE-2021-3121

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121

Release Date: 2021-01-11

Fix Resolution: v1.3.2

Vulnerable Library - github.com/docker/docker-v20.10.9

Moby Project - a collaborative project for the container ecosystem to assemble container-based systems

Dependency Hierarchy:

• github.com/ory/dockertest/v3-v3.8.1 (Root Library)
  • github.com/docker/cli-v20.10.11
    • ❌ github.com/docker/docker-v20.10.9 (Vulnerable Library)

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.

Publish Date: 2018-12-14

URL: CVE-2018-16875

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-16875

Release Date: 2018-12-14

Fix Resolution: 1.10.6,1.11.3

Vulnerable Library - github.com/docker/cli-v20.10.11

The Docker CLI

Dependency Hierarchy:

• github.com/ory/dockertest/v3-v3.8.1 (Root Library)
  • ❌ github.com/docker/cli-v20.10.11 (Vulnerable Library)

Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b

Found in base branch: main

Vulnerability Details

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.

Publish Date: 2020-12-07

URL: CVE-2020-8565

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GO-2020-0064

Release Date: 2020-12-07

Fix Resolution: v1.20.0-alpha.2