GHSA-xmmx-7jpf-fx42 GO-2024-2914
Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing
- Exploit chance (EPSS)
- 2.22%
- Chance of exploitation in the next 30 days. Higher than 82.70% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- Available
- 2 packages have a fixed version
Description
Impact
In the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header. Versions of Moby (Docker Engine) prior to 20.10.11 treat the Content-Type header as trusted and deserialize the document according to that header. If the Content-Type header changed between pulls of the same ambiguous document (with the same digest), the document may be interpreted differently, meaning that the digest alone is insufficient to unambiguously identify the content of the image.
Patches
This issue has been fixed in Moby (Docker Engine) 20.10.11. Image pulls for manifests that contain a “manifests” field or indices which contain a “layers” field are rejected.
Workarounds
Ensure you only pull images from trusted sources.
References
https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh
For more information
If you have any questions or comments about this advisory:
- Open an issue in
- Email us at security@docker.com
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/docker/docker | < 20.10.11 |
20.10.11 |
| github.com/docker/docker | < 20.10.11+incompatible |
20.10.11+incompatible |
| github.com/moby/moby | < 20.10.11 |
20.10.11 |
| github.com/moby/moby | < 20.10.11+incompatible |
20.10.11+incompatible |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/docker/docker Go → 20.10.11
- go
go get github.com/docker/docker@v20.10.11 && go mod tidy
github.com/moby/moby Go → 20.10.11
- go
go get github.com/moby/moby@v20.10.11 && go mod tidy
References
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-mc8v-mgrf-8f4m Clarify Content-Type handling | Low | Linked by the source |
| GHSA-rg2x-37c3-w2rh Docker: Race condition in docker cp allows bind mount redirection to host path | High | Also affects github.com/docker/docker |
| GHSA-vp62-88p7-qqf5 Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap | Medium | Also affects github.com/docker/docker |
| GHSA-x86f-5xw2-fm2r Docker: `PUT /containers/{id}/archive` executes container binary on the host | High | Also affects github.com/docker/docker |
| GO-2026-4887 Moby has AuthZ plugin bypass when provided oversized request bodies | High | Also affects github.com/docker/docker |
| GHSA-pxq6-2prw-chj9 Moby has an Off-by-one error in its plugin privilege validation | High | Also affects github.com/docker/docker |
| GHSA-4vq8-7jfc-9cvp Moby firewalld reload removes bridge network isolation | Medium | Also affects github.com/docker/docker |
| GHSA-x4rx-4gw3-53p4 Moby firewalld reload makes published container ports accessible from remote hosts | Medium | Also affects github.com/docker/docker |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor