CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-24557 – Moby classic builder cache poisoning
https://notcve.org/view.php?id=CVE-2024-24557
Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. • https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae https://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc • CWE-345: Insufficient Verification of Data Authenticity CWE-346: Origin Validation Error •
CVSS: 8.7EPSS: 0%CPEs: 2EXPL: 1CVE-2023-28840 – moby/moby's dockerd daemon encrypted overlay network may be unauthenticated
https://notcve.org/view.php?id=CVE-2023-28840
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in dockerd and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The overlay network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. • https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333 https://github.com/moby/moby/issues/43382 https://github.com/moby/moby/pull/45118 https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237 https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw https://lists.fedoraproject.org/archives/list/packa • CWE-203: Observable Discrepancy CWE-420: Unprotected Alternate Channel CWE-636: Not Failing Securely ('Failing Open') CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-28841 – moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted
https://notcve.org/view.php?id=CVE-2023-28841
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. • https://github.com/moby/libnetwork/blob/d9fae4c73daf76c3b0f77e14b45b8bf612ba764d/drivers/overlay/encryption.go#L205-L207 https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333 https://github.com/moby/moby/issues/43382 https://github.com/moby/moby/pull/45118 https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237 https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p https://gith • CWE-311: Missing Encryption of Sensitive Data CWE-636: Not Failing Securely ('Failing Open') CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28842 – moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated
https://notcve.org/view.php?id=CVE-2023-28842
Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. • https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333 https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237 https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC https://lists.fedoraproject.org/ • CWE-420: Unprotected Alternate Channel CWE-636: Not Failing Securely ('Failing Open') CWE-755: Improper Handling of Exceptional Conditions •