GHSA-qrqr-3x5j-2xw9 CVE-2018-12608
Docker Authentication Bypass
- Severity
- 7.5 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 0.92%
- Chance of exploitation in the next 30 days. Higher than 60.28% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
- Fix
17.06.0-ce- Upgrade github.com/docker/docker to this version or later
Description
An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA (as opposed to one signed by the configured CA root certificate) to authenticate.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/docker/docker | < 17.06.0-ce |
17.06.0-ce |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/docker/docker Go → 17.06.0-ce
- go
go get github.com/docker/docker@v17.06.0-ce && go mod tidy
Severity breakdown
CVSS 3.0 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
How to prevent it
- Architecture and Design: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-rg2x-37c3-w2rh Docker: Race condition in docker cp allows bind mount redirection to host path | High | Also affects github.com/docker/docker |
| GHSA-vp62-88p7-qqf5 Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap | Medium | Also affects github.com/docker/docker |
| GHSA-x86f-5xw2-fm2r Docker: `PUT /containers/{id}/archive` executes container binary on the host | High | Also affects github.com/docker/docker |
| GO-2026-4887 Moby has AuthZ plugin bypass when provided oversized request bodies | High | Also affects github.com/docker/docker |
| GHSA-pxq6-2prw-chj9 Moby has an Off-by-one error in its plugin privilege validation | High | Also affects github.com/docker/docker |
| GHSA-4vq8-7jfc-9cvp Moby firewalld reload removes bridge network isolation | Medium | Also affects github.com/docker/docker |
| GHSA-x4rx-4gw3-53p4 Moby firewalld reload makes published container ports accessible from remote hosts | Medium | Also affects github.com/docker/docker |
| GHSA-v23v-6jw2-98fq Authz zero length regression | Critical | Also affects github.com/docker/docker |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor