Moby to otwarty framework kontenerowy. W Docker Engine przed wersją 29.5.1, Docker Daemon w wersji 28.5.2 i wcześniejszych oraz Moby Daemon przed wersją 2.0.0-beta.14, race condition podczas konfiguracji mount w docker cp pozwala złośliwemu kontenerowi na utworzenie pustych plików lub katalogów w dowolnych ścieżkach bezwzględnych w systemie plików hosta. Problem został naprawiony w Docker Engine w wersji 29.5.1 i Moby Daemon w wersji 2.0.0-beta.14.
▸ Pokaż oryginał (EN)
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:HDocker Engine
APPDocker< 29.5.1Mobyproject Moby
APPMobyproject≤ 28.5.2Mobyproject Moby\/v2
APPMobyproject2.0.0
Powiązane podatności
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 2...
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detecte...
moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to tr...
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Co...
An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate us...