docker-stable-24.0.9_ce-15.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:16651 Final 1 1 2025-09-30T00:00:00Z current 2025-09-30T00:00:00Z 2025-09-30T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z docker-stable-24.0.9_ce-15.1 on GA media These are all security issues fixed in the docker-stable-24.0.9_ce-15.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2025-16651 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2014-3499/ SUSE CVE CVE-2014-3499 page https://www.suse.com/security/cve/CVE-2014-5277/ SUSE CVE CVE-2014-5277 page https://www.suse.com/security/cve/CVE-2014-6407/ SUSE CVE CVE-2014-6407 page https://www.suse.com/security/cve/CVE-2014-6408/ SUSE CVE CVE-2014-6408 page https://www.suse.com/security/cve/CVE-2014-8178/ SUSE CVE CVE-2014-8178 page https://www.suse.com/security/cve/CVE-2014-8179/ SUSE CVE CVE-2014-8179 page https://www.suse.com/security/cve/CVE-2014-9356/ SUSE CVE CVE-2014-9356 page https://www.suse.com/security/cve/CVE-2014-9357/ SUSE CVE CVE-2014-9357 page https://www.suse.com/security/cve/CVE-2014-9358/ SUSE CVE CVE-2014-9358 page https://www.suse.com/security/cve/CVE-2015-3627/ SUSE CVE CVE-2015-3627 page https://www.suse.com/security/cve/CVE-2015-3629/ SUSE CVE CVE-2015-3629 page https://www.suse.com/security/cve/CVE-2015-3630/ SUSE CVE CVE-2015-3630 page https://www.suse.com/security/cve/CVE-2015-3631/ SUSE CVE CVE-2015-3631 page https://www.suse.com/security/cve/CVE-2016-3697/ SUSE CVE CVE-2016-3697 page https://www.suse.com/security/cve/CVE-2016-8867/ SUSE CVE CVE-2016-8867 page https://www.suse.com/security/cve/CVE-2016-9962/ SUSE CVE CVE-2016-9962 page https://www.suse.com/security/cve/CVE-2017-14992/ SUSE CVE CVE-2017-14992 page https://www.suse.com/security/cve/CVE-2017-16539/ SUSE CVE CVE-2017-16539 page https://www.suse.com/security/cve/CVE-2018-10892/ SUSE CVE CVE-2018-10892 page https://www.suse.com/security/cve/CVE-2018-15664/ SUSE CVE CVE-2018-15664 page https://www.suse.com/security/cve/CVE-2018-16873/ SUSE CVE CVE-2018-16873 page https://www.suse.com/security/cve/CVE-2018-16874/ SUSE CVE CVE-2018-16874 page https://www.suse.com/security/cve/CVE-2018-16875/ SUSE CVE CVE-2018-16875 page https://www.suse.com/security/cve/CVE-2018-20699/ SUSE CVE CVE-2018-20699 page https://www.suse.com/security/cve/CVE-2019-13509/ SUSE CVE CVE-2019-13509 page https://www.suse.com/security/cve/CVE-2019-14271/ SUSE CVE CVE-2019-14271 page https://www.suse.com/security/cve/CVE-2020-12912/ SUSE CVE CVE-2020-12912 page https://www.suse.com/security/cve/CVE-2020-13401/ SUSE CVE CVE-2020-13401 page https://www.suse.com/security/cve/CVE-2020-15257/ SUSE CVE CVE-2020-15257 page https://www.suse.com/security/cve/CVE-2020-8694/ SUSE CVE CVE-2020-8694 page https://www.suse.com/security/cve/CVE-2020-8695/ SUSE CVE CVE-2020-8695 page https://www.suse.com/security/cve/CVE-2021-21284/ SUSE CVE CVE-2021-21284 page https://www.suse.com/security/cve/CVE-2021-41089/ SUSE CVE CVE-2021-41089 page https://www.suse.com/security/cve/CVE-2021-41092/ SUSE CVE CVE-2021-41092 page https://www.suse.com/security/cve/CVE-2021-41190/ SUSE CVE CVE-2021-41190 page https://www.suse.com/security/cve/CVE-2021-43565/ SUSE CVE CVE-2021-43565 page https://www.suse.com/security/cve/CVE-2022-24769/ SUSE CVE CVE-2022-24769 page https://www.suse.com/security/cve/CVE-2022-36109/ SUSE CVE CVE-2022-36109 page https://www.suse.com/security/cve/CVE-2023-28840/ SUSE CVE CVE-2023-28840 page https://www.suse.com/security/cve/CVE-2023-28841/ SUSE CVE CVE-2023-28841 page https://www.suse.com/security/cve/CVE-2023-28842/ SUSE CVE CVE-2023-28842 page https://www.suse.com/security/cve/CVE-2024-23651/ SUSE CVE CVE-2024-23651 page https://www.suse.com/security/cve/CVE-2024-23652/ SUSE CVE CVE-2024-23652 page openSUSE Tumbleweed docker-stable-24.0.9_ce-15.1 docker-stable-bash-completion-24.0.9_ce-15.1 docker-stable-buildx-0.25.0-15.1 docker-stable-fish-completion-24.0.9_ce-15.1 docker-stable-rootless-extras-24.0.9_ce-15.1 docker-stable-zsh-completion-24.0.9_ce-15.1 docker-stable-24.0.9_ce-15.1 as a component of openSUSE Tumbleweed docker-stable-bash-completion-24.0.9_ce-15.1 as a component of openSUSE Tumbleweed docker-stable-buildx-0.25.0-15.1 as a component of openSUSE Tumbleweed docker-stable-fish-completion-24.0.9_ce-15.1 as a component of openSUSE Tumbleweed docker-stable-rootless-extras-24.0.9_ce-15.1 as a component of openSUSE Tumbleweed docker-stable-zsh-completion-24.0.9_ce-15.1 as a component of openSUSE Tumbleweed Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors. CVE-2014-3499 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2014-3499.html CVE-2014-3499 https://bugzilla.suse.com/885209 SUSE Bug 885209 Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic. CVE-2014-5277 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2014-5277.html CVE-2014-5277 https://bugzilla.suse.com/904165 SUSE Bug 904165 Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation. CVE-2014-6407 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2014-6407.html CVE-2014-6407 https://bugzilla.suse.com/907012 SUSE Bug 907012 Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image. CVE-2014-6408 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2014-6408.html CVE-2014-6408 https://bugzilla.suse.com/907014 SUSE Bug 907014 Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands. CVE-2014-8178 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 1.9 AV:L/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2014-8178.html CVE-2014-8178 https://bugzilla.suse.com/949660 SUSE Bug 949660 Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation. CVE-2014-8179 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2014-8179.html CVE-2014-8179 https://bugzilla.suse.com/949660 SUSE Bug 949660 Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile. CVE-2014-9356 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 8.5 AV:N/AC:L/Au:N/C:N/I:C/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2014-9356.html CVE-2014-9356 https://bugzilla.suse.com/909710 SUSE Bug 909710 https://bugzilla.suse.com/909712 SUSE Bug 909712 https://bugzilla.suse.com/909747 SUSE Bug 909747 Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction. CVE-2014-9357 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2014-9357.html CVE-2014-9357 https://bugzilla.suse.com/909710 SUSE Bug 909710 https://bugzilla.suse.com/909747 SUSE Bug 909747 Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications." CVE-2014-9358 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2014-9358.html CVE-2014-9358 https://bugzilla.suse.com/909709 SUSE Bug 909709 https://bugzilla.suse.com/909747 SUSE Bug 909747 Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image. CVE-2015-3627 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 3.2 AV:L/AC:L/Au:S/C:P/I:P/A:N 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2015-3627.html CVE-2015-3627 https://bugzilla.suse.com/930235 SUSE Bug 930235 https://bugzilla.suse.com/945060 SUSE Bug 945060 Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container. CVE-2015-3629 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2015-3629.html CVE-2015-3629 https://bugzilla.suse.com/930235 SUSE Bug 930235 https://bugzilla.suse.com/945060 SUSE Bug 945060 Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image. CVE-2015-3630 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2015-3630.html CVE-2015-3630 https://bugzilla.suse.com/930235 SUSE Bug 930235 https://bugzilla.suse.com/945060 SUSE Bug 945060 Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc. CVE-2015-3631 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 3.6 AV:L/AC:L/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2015-3631.html CVE-2015-3631 https://bugzilla.suse.com/930235 SUSE Bug 930235 https://bugzilla.suse.com/945060 SUSE Bug 945060 libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container. CVE-2016-3697 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-3697.html CVE-2016-3697 https://bugzilla.suse.com/976777 SUSE Bug 976777 Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes. CVE-2016-8867 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-8867.html CVE-2016-8867 https://bugzilla.suse.com/1007249 SUSE Bug 1007249 RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container. CVE-2016-9962 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 4.1 AV:L/AC:M/Au:S/C:P/I:P/A:P 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9962.html CVE-2016-9962 https://bugzilla.suse.com/1012568 SUSE Bug 1012568 https://bugzilla.suse.com/1173425 SUSE Bug 1173425 Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing. CVE-2017-14992 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-14992.html CVE-2017-14992 https://bugzilla.suse.com/1066210 SUSE Bug 1066210 The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP. CVE-2017-16539 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 3.6 AV:L/AC:L/Au:N/C:N/I:P/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-16539.html CVE-2017-16539 https://bugzilla.suse.com/1066801 SUSE Bug 1066801 The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness. CVE-2018-10892 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-10892.html CVE-2018-10892 https://bugzilla.suse.com/1100331 SUSE Bug 1100331 https://bugzilla.suse.com/1100838 SUSE Bug 1100838 In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot). CVE-2018-15664 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-15664.html CVE-2018-15664 https://bugzilla.suse.com/1096726 SUSE Bug 1096726 https://bugzilla.suse.com/1139649 SUSE Bug 1139649 In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u". CVE-2018-16873 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16873.html CVE-2018-16873 https://bugzilla.suse.com/1118897 SUSE Bug 1118897 https://bugzilla.suse.com/1118898 SUSE Bug 1118898 https://bugzilla.suse.com/1118899 SUSE Bug 1118899 In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution. CVE-2018-16874 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16874.html CVE-2018-16874 https://bugzilla.suse.com/1118897 SUSE Bug 1118897 https://bugzilla.suse.com/1118898 SUSE Bug 1118898 https://bugzilla.suse.com/1118899 SUSE Bug 1118899 The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected. CVE-2018-16875 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16875.html CVE-2018-16875 https://bugzilla.suse.com/1118897 SUSE Bug 1118897 https://bugzilla.suse.com/1118898 SUSE Bug 1118898 https://bugzilla.suse.com/1118899 SUSE Bug 1118899 Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go. CVE-2018-20699 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 4 AV:N/AC:L/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-20699.html CVE-2018-20699 https://bugzilla.suse.com/1121768 SUSE Bug 1121768 In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret. CVE-2019-13509 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-13509.html CVE-2019-13509 https://bugzilla.suse.com/1142160 SUSE Bug 1142160 In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container. CVE-2019-14271 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-14271.html CVE-2019-14271 https://bugzilla.suse.com/1143409 SUSE Bug 1143409 A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access. CVE-2020-12912 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-12912.html CVE-2020-12912 https://bugzilla.suse.com/1178760 SUSE Bug 1178760 An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service. CVE-2020-13401 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 6 AV:N/AC:M/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-13401.html CVE-2020-13401 https://bugzilla.suse.com/1172375 SUSE Bug 1172375 https://bugzilla.suse.com/1172377 SUSE Bug 1172377 containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim's API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container. CVE-2020-15257 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 3.6 AV:L/AC:L/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-15257.html CVE-2020-15257 https://bugzilla.suse.com/1178969 SUSE Bug 1178969 Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. CVE-2020-8694 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-8694.html CVE-2020-8694 https://bugzilla.suse.com/1170415 SUSE Bug 1170415 https://bugzilla.suse.com/1170446 SUSE Bug 1170446 https://bugzilla.suse.com/1178591 SUSE Bug 1178591 https://bugzilla.suse.com/1178700 SUSE Bug 1178700 https://bugzilla.suse.com/1179661 SUSE Bug 1179661 Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. CVE-2020-8695 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-8695.html CVE-2020-8695 https://bugzilla.suse.com/1170415 SUSE Bug 1170415 https://bugzilla.suse.com/1170446 SUSE Bug 1170446 https://bugzilla.suse.com/1178591 SUSE Bug 1178591 In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user. CVE-2021-21284 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 2.7 AV:A/AC:L/Au:S/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-21284.html CVE-2021-21284 https://bugzilla.suse.com/1181732 SUSE Bug 1181732 Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host's filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted. CVE-2021-41089 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-41089.html CVE-2021-41089 https://bugzilla.suse.com/1191015 SUSE Bug 1191015 https://bugzilla.suse.com/1191355 SUSE Bug 1191355 Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH. CVE-2021-41092 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-41092.html CVE-2021-41092 https://bugzilla.suse.com/1191334 SUSE Bug 1191334 https://bugzilla.suse.com/1191355 SUSE Bug 1191355 The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both "manifests" and "layers" fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both "manifests" and "layers" fields or "manifests" and "config" fields if they are unable to update to version 1.0.1 of the spec. CVE-2021-41190 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-41190.html CVE-2021-41190 https://bugzilla.suse.com/1193273 SUSE Bug 1193273 The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server. CVE-2021-43565 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43565.html CVE-2021-43565 https://bugzilla.suse.com/1193930 SUSE Bug 1193930 Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a workaround, the entry point of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting. CVE-2022-24769 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-24769.html CVE-2022-24769 https://bugzilla.suse.com/1197517 SUSE Bug 1197517 Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly. CVE-2022-36109 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-36109.html CVE-2022-36109 https://bugzilla.suse.com/1205375 SUSE Bug 1205375 Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in dockerd and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The overlay network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the u32 iptables extension provided by the xt_u32 kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. Two iptables rules serve to filter incoming VXLAN datagrams with a VNI that corresponds to an encrypted network and discards unencrypted datagrams. The rules are appended to the end of the INPUT filter chain, following any rules that have been previously set by the system administrator. Administrator-set rules take precedence over the rules Moby sets to discard unencrypted VXLAN datagrams, which can potentially admit unencrypted datagrams that should have been discarded. The injection of arbitrary Ethernet frames can enable a Denial of Service attack. A sophisticated attacker may be able to establish a UDP or TCP connection by way of the container's outbound gateway that would otherwise be blocked by a stateful firewall, or carry out other escalations beyond simple injection by smuggling packets into the overlay network. Patches are available in Moby releases 23.0.3 and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some workarounds are available. Close the VXLAN port (by default, UDP port 4789) to incoming traffic at the Internet boundary to prevent all VXLAN packet injection, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster. CVE-2023-28840 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-28840.html CVE-2023-28840 https://bugzilla.suse.com/1214107 SUSE Bug 1214107 https://bugzilla.suse.com/1215525 SUSE Bug 1215525 Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. An iptables rule designates outgoing VXLAN datagrams with a VNI that corresponds to an encrypted overlay network for IPsec encapsulation. Encrypted overlay networks on affected platforms silently transmit unencrypted data. As a result, `overlay` networks may appear to be functional, passing traffic as expected, but without any of the expected confidentiality or data integrity guarantees. It is possible for an attacker sitting in a trusted position on the network to read all of the application traffic that is moving across the overlay network, resulting in unexpected secrets or user data disclosure. Thus, because many database protocols, internal APIs, etc. are not protected by a second layer of encryption, a user may use Swarm encrypted overlay networks to provide confidentiality, which due to this vulnerability this is no longer guaranteed. Patches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some workarounds are available. Close the VXLAN port (by default, UDP port 4789) to outgoing traffic at the Internet boundary in order to prevent unintentionally leaking unencrypted traffic over the Internet, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster. CVE-2023-28841 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-28841.html CVE-2023-28841 https://bugzilla.suse.com/1214108 SUSE Bug 1214108 https://bugzilla.suse.com/1215525 SUSE Bug 1215525 Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. The `overlay` driver dynamically and lazily defines the kernel configuration for the VXLAN network on each node as containers are attached and detached. Routes and encryption parameters are only defined for destination nodes that participate in the network. The iptables rules that prevent encrypted overlay networks from accepting unencrypted packets are not created until a peer is available with which to communicate. Encrypted overlay networks silently accept cleartext VXLAN datagrams that are tagged with the VNI of an encrypted overlay network. As a result, it is possible to inject arbitrary Ethernet frames into the encrypted overlay network by encapsulating them in VXLAN datagrams. The implications of this can be quite dire, and GHSA-vwm3-crmr-xfxw should be referenced for a deeper exploration. Patches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some workarounds are available. In multi-node clusters, deploy a global 'pause' container for each encrypted overlay network, on every node. For a single-node cluster, do not use overlay networks of any sort. Bridge networks provide the same connectivity on a single node and have no multi-node features. The Swarm ingress feature is implemented using an overlay network, but can be disabled by publishing ports in `host` mode instead of `ingress` mode (allowing the use of an external load balancer), and removing the `ingress` network. If encrypted overlay networks are in exclusive use, block UDP port 4789 from traffic that has not been validated by IPSec. CVE-2023-28842 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-28842.html CVE-2023-28842 https://bugzilla.suse.com/1214109 SUSE Bug 1214109 https://bugzilla.suse.com/1215525 SUSE Bug 1215525 BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container. The issue has been fixed in v0.12.5. Workarounds include, avoiding using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with --mount=type=cache,source=... options. CVE-2024-23651 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-23651.html CVE-2024-23651 https://bugzilla.suse.com/1219267 SUSE Bug 1219267 BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature. CVE-2024-23652 openSUSE Tumbleweed:docker-stable-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-bash-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-buildx-0.25.0-15.1 openSUSE Tumbleweed:docker-stable-fish-completion-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-rootless-extras-24.0.9_ce-15.1 openSUSE Tumbleweed:docker-stable-zsh-completion-24.0.9_ce-15.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-23652.html CVE-2024-23652 https://bugzilla.suse.com/1219268 SUSE Bug 1219268