Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
63 results · page 1 of 2
Oct 8, 2026The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files.CVE-2026-61801 · Other software · moby · reported by GitHubMedium 5.5
The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.
- Product
- sys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.CVE-2026-93321 · Other software · moby · reported by security@docker.comMedium 6.9
A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup.CVE-2026-93315 · Other software · moby · reported by security@docker.comMedium 5.8
When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A build step for a Git source, crafted in a specific way, can bypass some policy validation rules.CVE-2026-93326 · Other software · moby · reported by security@docker.comMedium 6
A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, for example based on commit SHA, commit data, or signatures, then all these validations still apply correctly.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit.CVE-2026-93323 · Other software · moby · reported by security@docker.comMedium 6.8
The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which interrupts other builds on the same instance. Fixed by rejecting such files above 16 MiB.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.CVE-2026-93322 · Other software · moby · reported by security@docker.comMedium 6.9
A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026BuildKit may be tricked into performing file actions with special file inodes where regular files are expected.CVE-2026-93320 · Other software · moby · reported by security@docker.comMedium 6
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon toCVE-2026-93319 · Other software · moby · reported by security@docker.comMedium 5.7
A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A malicious image can advertise DiffIDs from another image while containing different layer contents.CVE-2026-93318 · Other software · moby · reported by security@docker.comHigh 7.5
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with shared or persistent cache first processes such a malicious image, a later build using the victim image may mount the attacker-controlled layer contents as the base image. This can allow code from the malicious image to run in the victim build, for example by replacing a commonly executed path such as /bin/sh. The attacker-controlled code may read build secrets mounted into the build, access other build resources, alter output artifacts, or hang the build. The issue affects both regular snapshotters and lazy-pulling snapshotters such as stargz.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest.CVE-2026-93317 · Other software · moby · reported by security@docker.comMedium 5.9
An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices.CVE-2026-93316 · Other software · moby · reported by security@docker.comHigh 7.1
If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.CVE-2026-75593 · Other software · moby · reported by GitHubHigh 7.2
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is fixed in version 0.31.2.
- Product
- buildkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.CVE-2026-61712 · Other software · moby · reported by GitHubLow 2.3
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.
- Product
- buildkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.CVE-2026-61711 · Other software · moby · reported by GitHubMedium 5.3
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/spec_linux.go treated the unsupported value as a non-sandbox mode without requiring the security.insecure entitlement. This disabled Seccomp and AppArmor protections for the build container even though Linux capabilities remained restricted. This issue is fixed in version 0.31.1.
- Product
- buildkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations tCVE-2026-17106 · Other software · moby · reported by security@docker.comHigh 7.1
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.
- Product
- go-archive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comdocs.docker.com
Jul 21, 2026BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources.CVE-2026-15793 · Other software · moby · reported by security@docker.comHigh 7.3
BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.CVE-2026-15792 · Other software · moby · reported by security@docker.comMedium 6
A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory.CVE-2026-15791 · Other software · moby · reported by security@docker.comLow 1.8
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory.CVE-2026-15789 · Other software · moby · reported by security@docker.comMedium 6.9
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root.CVE-2026-15788 · Other software · moby · reported by security@docker.comMedium 5.6
BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Moby is an open source container framework.CVE-2026-42306 · Other software · moby · reported by GitHubHigh 7.2
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Moby is an open source container framework.CVE-2026-41568 · Other software · moby · reported by GitHubMedium 6.1
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026Moby is an open source container framework.CVE-2026-41567 · Other software · moby · reported by GitHubHigh 7.2
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images
- Product
- moby/v2/daemon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Apr 16, 2026spdystream is a Go library for multiplexing streams over SPDY connections.CVE-2026-35469 · Other software · moby · reported by GitHubHigh 8.7
spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.
- Product
- spdystream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Moby is an open source container framework.CVE-2026-34040 · Other software · moby · reported by GitHubHigh 8.8
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Moby is an open source container framework.CVE-2026-33997 · Other software · moby · reported by GitHubMedium 6.8
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.CVE-2026-33748 · Other software · moby · reported by GitHubHigh 8.2
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.
- Product
- buildkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comgithub.com
Mar 26, 2026BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.CVE-2026-33747 · Other software · moby · reported by GitHubHigh 8.4
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.
- Product
- buildkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026In mObywatel iOS application an unauthorized user can use the App Switcher to view the account owner's personal information in the minimized app window, even afCVE-2025-11598 · Other software · Centralny Ośrodek Informatyki · reported by cvd@cert.plLow 1
In mObywatel iOS application an unauthorized user can use the App Switcher to view the account owner's personal information in the minimized app window, even after the login session has ended (reopening the app would require the user to log in). The data exposed depends on the last application view displayed before the application was minimized This issue was fixed in version 4.71.0
- Product
- mObywatel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plinfo.mobywatel.gov.pl
Jul 30, 2025Moby is an open source container framework developed by Docker Inc.CVE-2025-54410 · Other software · moby · reported by GitHubLow 3.3
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails to re-create iptables rules that isolate bridge networks, allowing any container to access all ports on any other container across different bridge networks on the same host. This breaks network segmentation between containers that should be isolated, creating significant risk in multi-tenant environments. Only containers in --internal networks remain protected. Workarounds include reloading firewalld and either restarting the docker daemon, re-creating bridge networks, or using rootless mode. Maintainers anticipate a fix for this issue in version 25.0.13.
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfirewalld.orggithub.com
Jul 30, 2025Moby is an open source container framework developed by Docker Inc.CVE-2025-54388 · Other software · moby · reported by GitHubMedium 5.1
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2024moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resultiCVE-2024-36623 · Other software · Mobyproject · reported by MITREHigh 8.1
moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.
- Product
- Moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 29, 2024moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go.CVE-2024-36621 · Other software · Mobyproject · reported by MITREMedium 6.5
moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.
- Product
- Moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 29, 2024moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.CVE-2024-36620 · Other software · Mobyproject · reported by MITREMedium 6.5
moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.
- Product
- Moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 24, 2024Moby is an open-source project created by Docker for software containerization.CVE-2024-41110 · Other software · moby · reported by GitHubCritical 9.9
Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low. Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it. A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted. Docker EE v19.03.x and all versions of Mirantis Container Runtime are not
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2024Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes.CVE-2024-32473 · Other software · moby · reported by GitHubMedium 4.7
Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. In 26.0.0, IPv6 is not disabled on network interfaces, including those belonging to networks where `--ipv6=false`. An container with an `ipvlan` or `macvlan` interface will normally be configured to share an external network link with the host machine. Because of this direct access, (1) Containers may be able to communicate with other hosts on the local network over link-local IPv6 addresses, (2) if router advertisements are being broadcast over the local network, containers may get SLAAC-assigned addresses, and (3) the interface will be a member of IPv6 multicast groups. This means interfaces in IPv4-only networks present an unexpectedly and unnecessarily increased attack surface. The issue is patched in 26.0.2. To completely disable IPv6 in a container, use `--sysctl=net.ipv6.conf.all.disable_ipv6=1` in the `docker create` or `docker run` command. Or, in the service configuration of a `compose` file.
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes.CVE-2024-29018 · Other software · moby · reported by GitHubMedium 5.9
Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well. When containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs. Containers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gatew
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2024Moby is an open-source project created by Docker to enable software containerization.CVE-2024-24557 · Other software · moby · reported by GitHubMedium 6.9
Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2024BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.CVE-2024-23653 · Other software · moby · reported by GitHubCritical 9.8
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special `security.insecure` entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request. The issue has been fixed in v0.12.5 . Avoid using BuildKit frontends from untrusted sources.
- Product
- buildkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2024BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.CVE-2024-23652 · Other software · moby · reported by GitHubCritical 10
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.
- Product
- buildkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2024BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.CVE-2024-23651 · Other software · moby · reported by GitHubHigh 8.7
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container. The issue has been fixed in v0.12.5. Workarounds include, avoiding using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with --mount=type=cache,source=... options.
- Product
- buildkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2024BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.CVE-2024-23650 · Other software · moby · reported by GitHubMedium 5.3
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.
- Product
- buildkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023Moby) is an open source container framework developed by Docker Inc.CVE-2023-28842 · Other software · moby · reported by GitHubMedium 6.8
Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN da
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023Moby is an open source container framework developed by Docker Inc.CVE-2023-28841 · Other software · moby · reported by GitHubMedium 6.8
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN dat
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023Moby is an open source container framework developed by Docker Inc.CVE-2023-28840 · Other software · moby · reported by GitHubHigh 7.5
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in dockerd and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The overlay network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPs
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.CVE-2023-26054 · Other software · moby · reported by GitHubMedium 6.5
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation. Git URL can be passed in two ways: 1) Invoking build directly from a URL with credentials. 2) If the client sends additional version control system (VCS) info hint parameters on builds from a local source. Usually, that would mean reading the origin URL from `.git/config` file. When a build is performed under specific conditions where credentials were passed to BuildKit they may be visible to everyone who has access to provenance attestation. Provenance attestations and VCS info hints were added in version v0.11.0. Previous versions are not vulnerable. In v0.10, when building directly from Git URL, the same URL could be visible in `BuildInfo` structure that is a predecessor of Provenance attestations. Previous versions are not vulnerable. This bug has been fixed in v0.11.4. Users are advised to upgrade. Users unable to upgra
- Product
- buildkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2023HyperKit is a toolkit for embedding hypervisor capabilities in an application.CVE-2021-32847 · Other software · moby · reported by GitHubHigh 7.1
HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior, a malicious guest can trigger a vulnerability in the host by abusing the disk driver that may lead to the disclosure of the host memory into the virtualized guest. This issue is fixed in commit cf60095a4d8c3cb2e182a14415467afd356e982f.
- Product
- hyperkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2023HyperKit is a toolkit for embedding hypervisor capabilities in an application.CVE-2021-32846 · Other software · moby · reported by GitHubHigh 7.7
HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107, function `pci_vtsock_proc_tx` in `virtio-sock` can lead to to uninitialized memory use. In this situation, there is a check for the return value to be less or equal to `VTSOCK_MAXSEGS`, but that check is not sufficient because the function can return `-1` if it finds an error it cannot recover from. Moreover, the negative return value will be used by `iovec_pull` in a while condition that can further lead to more corruption because the function is not designed to handle a negative `iov_len`. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit af5eba2360a7351c08dfd9767d9be863a50ebaba.
- Product
- hyperkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2023HyperKit is a toolkit for embedding hypervisor capabilities in an application.CVE-2021-32845 · Other software · moby · reported by GitHubHigh 7.7
HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of `qnotify` at `pci_vtrnd_notify` fails to check the return value of `vq_getchain`. This leads to `struct iovec iov;` being uninitialized and used to read memory in `len = (int) read(sc->vrsc_fd, iov.iov_base, iov.iov_len);` when an attacker is able to make `vq_getchain` fail. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit 41272a980197917df8e58ff90642d14dec8fe948.
- Product
- hyperkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2023HyperKit is a toolkit for embedding hypervisor capabilities in an application.CVE-2021-32844 · Other software · moby · reported by GitHubMedium 6.2
HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, ` vi_pci_write` has is a call to `vc_cfgwrite` that does not check for null which when called makes the host crash. This issue may lead to a guest crashing the host causing a denial of service. This issue is fixed in commit 451558fe8aaa8b24e02e34106e3bb9fe41d7ad13.
- Product
- hyperkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.