CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-25365
https://notcve.org/view.php?id=CVE-2022-25365
Docker Desktop before 4.5.1 on Windows allows attackers to move arbitrary files. NOTE: this issue exists because of an incomplete fix for CVE-2022-23774. Docker Desktop versiones anteriores a 4.5.1 en Windows, permite a atacantes mover archivos arbitrarios. NOTA: este problema se presenta debido a una corrección incompleta de CVE-2022-23774 • https://github.com/followboy1999/CVE-2022-25365 https://docs.docker.com/desktop/windows/release-notes https://security.netapp.com/advisory/ntap-20220331-0001 •
CVSS: 7.9EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33183
https://notcve.org/view.php?id=CVE-2021-33183
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume management component in Synology Docker before 18.09.0-0515 allows local users to read or write arbitrary files via unspecified vectors. Una vulnerabilidad de limitación inapropiada de un nombre de ruta a un directorio restringido ("Path Traversal") del componente container volume management en Synology Docker versiones anteriores a 18.09.0-0515, permite a usuarios locales leer o escribir archivos arbitrarios por medio de vectores no especificados • https://www.synology.com/security/advisory/Synology_SA_21_08 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-21284 – privilege escalation in Moby
https://notcve.org/view.php?id=CVE-2021-21284
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user. En Docker versiones anteriores a 9.03.15, 20.10.3, se presenta una vulnerabilidad que involucra la opción --userns-remap en la que un acceso a una root reasignada permite una escalada de privilegios a la root actual. Cuando se usa "--userns-remap", si el usuario root en el espacio de nombres reasignado tiene acceso al sistema de archivos del host, puede modificar archivos en "/var/lib/docker/(remapping)" que causa la escritura de archivos con privilegios extendidos. • https://docs.docker.com/engine/release-notes/#20103 https://github.com/moby/moby/commit/64bd4485b3a66a597c02c95f5776395e540b2c7c https://github.com/moby/moby/releases/tag/v19.03.15 https://github.com/moby/moby/releases/tag/v20.10.3 https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc https://security.gentoo.org/glsa/202107-23 https://security.netapp.com/advisory/ntap-20210226-0005 https://www.debian.org/security/2021/dsa-4865 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-21285 – Docker daemon crash during image pull of malicious image
https://notcve.org/view.php?id=CVE-2021-21285
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing. En Docker versiones anteriores a 9.03.15, 20.10.3, se presenta una vulnerabilidad en la que al extraer un manifiesto de imagen de Docker malformado intencionalmente, bloquea al demonio dockerd. Las versiones 20.10.3 y 19.03.15 contienen parches que impiden al demonio bloquearse • https://docs.docker.com/engine/release-notes/#20103 https://github.com/moby/moby/commit/8d3179546e79065adefa67cc697c09d0ab137d30 https://github.com/moby/moby/releases/tag/v19.03.15 https://github.com/moby/moby/releases/tag/v20.10.3 https://github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8 https://security.gentoo.org/glsa/202107-23 https://security.netapp.com/advisory/ntap-20210226-0005 https://www.debian.org/security/2021/dsa-4865 • CWE-400: Uncontrolled Resource Consumption CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-3162
https://notcve.org/view.php?id=CVE-2021-3162
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation. Docker Desktop Community versiones anteriores a 2.5.0.0 en macOS, maneja inapropiadamente una comprobación de certificados, conllevando a una escalada de privilegios local • https://docs.docker.com/docker-for-mac/release-notes/#docker-desktop-community-2500 https://twitter.com/_r3ggi • CWE-295: Improper Certificate Validation •