GHSA-6fj5-m822-rqx8

Suggest an improvement
Source
https://github.com/advisories/GHSA-6fj5-m822-rqx8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-6fj5-m822-rqx8/GHSA-6fj5-m822-rqx8.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-6fj5-m822-rqx8
Aliases
Related
Published
2024-01-31T23:16:46Z
Modified
2024-06-10T18:39:20Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
moby docker daemon crash during image pull of malicious image
Details

Impact

Pulling an intentionally malformed Docker image manifest crashes the dockerd daemon.

Patches

Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.

Credits

Maintainers would like to thank Josh Larsen, Ian Coldwater, Duffie Cooley, Rory McCune for working on the vulnerability and Brad Geesaman for responsibly disclosing it to security@docker.com.

Database specific
{
    "nvd_published_at": "2021-02-02T18:15:00Z",
    "cwe_ids": [
        "CWE-400",
        "CWE-754"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-31T23:16:46Z"
}
References

Affected packages

Go / github.com/moby/moby

Package

Name
github.com/moby/moby
View open source insights on deps.dev
Purl
pkg:golang/github.com/moby/moby

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
19.3.15

Go / github.com/moby/moby

Package

Name
github.com/moby/moby
View open source insights on deps.dev
Purl
pkg:golang/github.com/moby/moby

Affected ranges

Type
SEMVER
Events
Introduced
20.10.0-beta1
Fixed
20.10.3