Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low. Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it. A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted. Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable. docker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.

According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Moby is an open-source project created by Docker for software containerization. A security vulnerability     has been detected in certain versions of Docker Engine, which could allow an attacker to bypass     authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is     low. Using a specially-crafted API request, an Engine API client could make the daemon forward the request     or response to an authorization plugin without the body. In certain circumstances, the authorization     plugin may allow a request which it would have otherwise denied if the body had been forwarded to it. A     security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially     crafted API request. This could lead to unauthorized actions, including privilege escalation. Although     this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later     major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the     request and/or response body to make access control decisions is potentially impacted. Docker EE v19.03.x     and all versions of Mirantis Container Runtime are not vulnerable. docker-ce v27.1.1 containes patches to     fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0,     and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or     restrict access to the Docker API to trusted parties, following the principle of least     privilege.(CVE-2024-41110)

Tenable has extracted the preceding description block directly from the EulerOS docker-engine security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3918 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3918-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     October 13, 2024                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : docker.io     Version        : 20.10.5+dfsg1-1+deb11u3     CVE ID         : CVE-2024-41110     Debian Bug     : 1084993

    A vulnerability has been detected in     the Docker Engine, which could allow an attacker     to bypass authorization plugins (AuthZ) under specific     circumstances.

    For Debian 11 bullseye, this problem has been fixed in version     20.10.5+dfsg1-1+deb11u3.

    We recommend that you upgrade your docker.io packages.

    For the detailed security status of docker.io please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/docker.io

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Moby is an open-source project created by Docker for software containerization. A security vulnerability     has been detected in certain versions of Docker Engine, which could allow an attacker to bypass     authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is     low.  Using a specially-crafted API request, an Engine API client could make the daemon forward the     request or response to an authorization plugin without the body. In certain circumstances, the     authorization plugin may allow a request which it would have otherwise denied if the body had been     forwarded to it.  A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins     using a specially crafted API request. This could lead to unauthorized actions, including privilege     escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not     carried forward to later major versions, resulting in a regression. Anyone who depends on authorization     plugins that introspect the request and/or response body to make access control decisions is potentially     impacted.  Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.  docker-     ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master,     19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately,     avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the     principle of least privilege.(CVE-2024-41110)

Tenable has extracted the preceding description block directly from the EulerOS docker-engine security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and     other distributions of container tooling or runtimes. In 26.0.0, IPv6 is not disabled on network     interfaces, including those belonging to networks where `--ipv6=false`. An container with an `ipvlan` or     `macvlan` interface will normally be configured to share an external network link with the host machine.
    Because of this direct access, (1) Containers may be able to communicate with other hosts on the local     network over link-local IPv6 addresses, (2) if router advertisements are being broadcast over the local     network, containers may get SLAAC-assigned addresses, and (3) the interface  will be a member of IPv6     multicast groups. This means interfaces in IPv4-only networks present an unexpectedly and unnecessarily     increased attack surface. The issue is patched in 26.0.2. To completely disable IPv6 in a container, use     `--sysctl=net.ipv6.conf.all.disable_ipv6=1` in the `docker create` or `docker run` command. Or, in the     service configuration of a `compose` file.(CVE-2024-32473)

    Moby is an open-source project created by Docker for software containerization. A security vulnerability     has been detected in certain versions of Docker Engine, which could allow an attacker to bypass     authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is     low.  Using a specially-crafted API request, an Engine API client could make the daemon forward the     request or response to an authorization plugin without the body. In certain circumstances, the     authorization plugin may allow a request which it would have otherwise denied if the body had been     forwarded to it.  A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins     using a specially crafted API request. This could lead to unauthorized actions, including privilege     escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not     carried forward to later major versions, resulting in a regression. Anyone who depends on authorization     plugins that introspect the request and/or response body to make access control decisions is potentially     impacted.  Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.  docker-     ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master,     19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately,     avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the     principle of least privilege.(CVE-2024-41110)

Tenable has extracted the preceding description block directly from the EulerOS docker-engine security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300044.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2630 advisory.

    Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability     (CVE-2024-35255)

    The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export     telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the     collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue.  It is also     fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1. (CVE-2024-36129)

    AWS is aware of CVE-2024-41110, an issue affecting the Moby open source project, packaged in Amazon Linux     as docker. Docker is a component of several open source container management systems.

    This issue does not affect the default configuration of docker. If an authorization plugin is enabled, a     specially-crafted API request to the docker daemon will be forwarded to the authorization plugin in a way     that could lead to unintended actions, such as privilege escalation. Enabling an authorization plugin is     an atypical configuration. The affected API endpoint is not exposed to the network in either the default,     typical, or recommended configurations. The default EKS and ECS configurations do not expose the API     endpoint to the network. Enabling a Docker authorization plugin is not supported when using ECS. Finally,     docker is not installed on EKS AMIs newer than 1.24. Although Docker is installed in EKS 1.24 and earlier,     EKS does not support authorization plugins.

    Updated docker packages addressing the issue are available for Amazon Linux 2 (docker-20.10.25-1.amzn2.0.5     and docker-25.0.6-1.amzn2.0.1) and for Amazon Linux 2023 (docker-25.0.6-1amzn2023.0.1). AWS recommends     that customers using docker upgrade to these or later versions. (CVE-2024-41110)

    go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead     to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability,     CVE-2024-6104, was fixed in go-retryablehttp 0.7.7. (CVE-2024-6104)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-708 advisory.

    Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability     (CVE-2024-35255)

    The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export     telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the     collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue.  It is also     fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1. (CVE-2024-36129)

    AWS is aware of CVE-2024-41110, an issue affecting the Moby open source project, packaged in Amazon Linux     as docker. Docker is a component of several open source container management systems.

    This issue does not affect the default configuration of docker. If an authorization plugin is enabled, a     specially-crafted API request to the docker daemon will be forwarded to the authorization plugin in a way     that could lead to unintended actions, such as privilege escalation. Enabling an authorization plugin is     an atypical configuration. The affected API endpoint is not exposed to the network in either the default,     typical, or recommended configurations. The default EKS and ECS configurations do not expose the API     endpoint to the network. Enabling a Docker authorization plugin is not supported when using ECS. Finally,     docker is not installed on EKS AMIs newer than 1.24. Although Docker is installed in EKS 1.24 and earlier,     EKS does not support authorization plugins.

    Updated docker packages addressing the issue are available for Amazon Linux 2 (docker-20.10.25-1.amzn2.0.5     and docker-25.0.6-1.amzn2.0.1) and for Amazon Linux 2023 (docker-25.0.6-1amzn2023.0.1). AWS recommends     that customers using docker upgrade to these or later versions. (CVE-2024-41110)

    go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead     to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability,     CVE-2024-6104, was fixed in go-retryablehttp 0.7.7. (CVE-2024-6104)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of docker installed on the remote host is prior to 25.0.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-042 advisory.

    When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial     domain, an http.Client does not forward sensitive headers such as Authorization or Cookie. For     example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to     bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly     forwarded. (CVE-2023-45289)

    The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid     JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any     value, or when the UnmarshalOptions.DiscardUnknown option is set. (CVE-2024-24786)

    The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6     addresses, returning false for addresses which would return true in their traditional IPv4 forms.
    (CVE-2024-24790)

    Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and     other distributions of container tooling or runtimes. Moby's networking implementation allows for many     networks, each with their own IP address range and gateway, to be defined. This feature is frequently     referred to as custom networks, as each network can have a different driver, set of parameters and thus     behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_.
    The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and     other API clients may specify the `internal` parameter as well.

    When containers with networking are created, they are assigned unique network interfaces and IP addresses.
    The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from     container IPs.

    Containers on an internal network may communicate between each other, but are precluded from communicating     with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall     rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus     appropriately configured host services) is possible, and the host may communicate with any container IP     directly.

    In addition to configuring the Linux kernel's various networking features to enable container networking,     `dockerd` directly provides some services to container networks. Principal among these is serving as a     resolver, enabling service discovery, and resolution of names from an upstream resolver.

    When a DNS request for a name that does not correspond to a container is received, the request is     forwarded to the configured upstream resolver. This request is made from the container's network     namespace: the level of access and routing of traffic is the same as if the request was made by the     container itself.

    As a consequence of this design, containers solely attached to an internal network will be unable to     resolve names using the upstream resolver, as the container itself is unable to communicate with that     nameserver. Only the names of containers also attached to the internal network are able to be resolved.

    Many systems run a local forwarding DNS resolver. As the host and any containers have separate loopback     devices, a consequence of the design described above is that containers are unable to resolve names from     the host's configured resolver, as they cannot reach these addresses on the host loopback device. To     bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver     is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the     host namework namespace. The loopback resolver then forwards the requests to its configured upstream     resolvers, as expected.

    Because `dockerd` forwards DNS requests to the host loopback device, bypassing the container network     namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to     an external nameserver. By registering a domain for which they control the authoritative nameservers, an     attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that     will eventually be answered by their nameservers.

    Docker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.

    Moby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal     networks. As a workaround, run containers intended to be solely attached to internal networks with a     custom upstream address, which will force all upstream DNS queries to be resolved from the container's     network namespace. (CVE-2024-29018)

    AWS is aware of CVE-2024-41110, an issue affecting the Moby open source project, packaged in Amazon Linux     as docker. Docker is a component of several open source container management systems.

    This issue does not affect the default configuration of docker. If an authorization plugin is enabled, a     specially-crafted API request to the docker daemon will be forwarded to the authorization plugin in a way     that could lead to unintended actions, such as privilege escalation. Enabling an authorization plugin is     an atypical configuration. The affected API endpoint is not exposed to the network in either the default,     typical, or recommended configurations. The default EKS and ECS configurations do not expose the API     endpoint to the network. Enabling a Docker authorization plugin is not supported when using ECS. Finally,     docker is not installed on EKS AMIs newer than 1.24. Although Docker is installed in EKS 1.24 and earlier,     EKS does not support authorization plugins.

    Updated docker packages addressing the issue are available for Amazon Linux 2 (docker-20.10.25-1.amzn2.0.5     and docker-25.0.6-1.amzn2.0.1) and for Amazon Linux 2023 (docker-25.0.6-1amzn2023.0.1). AWS recommends     that customers using docker upgrade to these or later versions. (CVE-2024-41110)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3120-1 advisory.

    Changes in docker:
    - CVE-2024-23651: Fixed arbitrary files write due to race condition on mounts (bsc#1219267)
    - CVE-2024-23652: Fixed insufficient validation of parent directory on mount (bsc#1219268)
    - CVE-2024-23653: Fixed insufficient validation on entitlement on container creation via buildkit     (bsc#1219438)
    - CVE-2024-41110: A Authz zero length regression that could lead to authentication bypass was fixed     (bsc#1228324)

    Other fixes:

    - Update to Docker 25.0.6-ce. See upstream changelog online at       <https://docs.docker.com/engine/release-notes/25.0/#2506>
    - Update to Docker 25.0.5-ce (bsc#1223409)

    - Fix BuildKit's symlink resolution logic to correctly handle non-lexical       symlinks. (bsc#1221916)
    - Write volume options atomically so sudden system crashes won't result in       future Docker starts failing due to empty files. (bsc#1214855)

    Changes in buildah:
    - Update to version 1.35.4:
      * [release-1.35] Bump to Buildah v1.35.4
      * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
      * integration test: handle new labels in 'bud and test --unsetlabel'
      * [release-1.35] Bump go-jose CVE-2024-28180
      * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180

    - Update to version 1.35.3:
      * [release-1.35] Bump to Buildah v1.35.3
      * [release-1.35] correctly configure /etc/hosts and resolv.conf
      * [release-1.35] buildah: refactor resolv/hosts setup.
      * [release-1.35] rename the hostFile var to reflect
      * [release-1.35] Bump c/common to v0.58.1
      * [release-1.35] Bump Buildah to v1.35.2
      * [release-1.35] CVE-2024-24786 protobuf to 1.33
      * [release-1.35] Bump to v1.35.2-dev

    - Update to version 1.35.1:
      * [release-1.35] Bump to v1.35.1
      * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)

    - Buildah dropped cni support, require netavark instead (bsc#1221243)

    - Remove obsolete requires libcontainers-image & libcontainers-storage

    - Require passt for rootless networking (poo#156955)       Buildah moved to passt/pasta for rootless networking from slirp4netns       (https://github.com/containers/common/pull/1846)

    - Update to version 1.35.0:
      * Bump v1.35.0
      * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
      * conformance tests: don't break on trailing zeroes in layer blobs
      * Add a conformance test for copying to a mounted prior stage
      * fix(deps): update module github.com/stretchr/testify to v1.9.0
      * cgroups: reuse version check from c/common
      * Update vendor of containers/(common,image)
      * fix(deps): update github.com/containers/storage digest to eadc620
      * fix(deps): update github.com/containers/luksy digest to ceb12d4
      * fix(deps): update github.com/containers/image/v5 digest to cdc6802
      * manifest add: complain if we get artifact flags without --artifact
      * Use retry logic from containers/common
      * Vendor in containers/(storage,image,common)
      * Update module golang.org/x/crypto to v0.20.0
      * Add comment re: Total Success task name
      * tests: skip_if_no_unshare(): check for --setuid
      * Properly handle build --pull=false
      * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
      * Update module go.etcd.io/bbolt to v1.3.9
      * Revert 'Reduce official image size'
      * Update module github.com/opencontainers/image-spec to v1.1.0
      * Reduce official image size
      * Build with CNI support on FreeBSD
      * build --all-platforms: skip some base 'image' platforms
      * Bump main to v1.35.0-dev
      * Vendor in latest containers/(storage,image,common)
      * Split up error messages for missing --sbom related flags
      * `buildah manifest`: add artifact-related options
      * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
      * cmd/buildah/manifest.go: don't make struct declarations aliases
      * Use golang.org/x/exp/slices.Contains
      * Disable loong64 again
      * Fix a couple of typos in one-line comments
      * egrep is obsolescent; use grep -E
      * Try Cirrus with a newer VM version
      * Set CONTAINERS_CONF in the chroot-mount-flags integration test
      * Update to match dependency API update
      * Update github.com/openshift/imagebuilder and containers/common
      * docs: correct default authfile path
      * fix(deps): update module github.com/containerd/containerd to v1.7.13
      * tests: retrofit test for heredoc summary
      * build, heredoc: show heredoc summary in build output
      * manifest, push: add support for --retry and --retry-delay
      * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
      * imagebuildah: fix crash with empty RUN
      * fix(deps): update github.com/containers/luksy digest to b62d551
      * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
      * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
      * Make buildah match podman for handling of ulimits
      * docs: move footnotes to where they're applicable
      * Allow users to specify no-dereference
      * Run codespell on code
      * Fix FreeBSD version parsing
      * Fix a build break on FreeBSD
      * Remove a bad FROM line
      * fix(deps): update module github.com/onsi/gomega to v1.31.1
      * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
      * docs: use reversed logo for dark theme in README
      * build,commit: add --sbom to scan and produce SBOMs when committing
      * commit: force omitHistory if the parent has layers but no history
      * docs: fix a couple of typos
      * internal/mkcw.Archive(): handle extra image content
      * stage_executor,heredoc: honor interpreter in heredoc
      * stage_executor,layers: burst cache if heredoc content is changed
      * fix(deps): update module golang.org/x/crypto to v0.18.0
      * Replace map[K]bool with map[K]struct{} where it makes sense
      * fix(deps): update module golang.org/x/sync to v0.6.0
      * fix(deps): update module golang.org/x/term to v0.16.0
      * Bump CI VMs
      * Replace strings.SplitN with strings.Cut
      * fix(deps): update github.com/containers/storage digest to ef81e9b
      * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
      * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
      * Document use of containers-transports values in buildah
      * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
      * chore(deps): update dependency containers/automation_images to v20231208
      * manifest: addCompression use default from containers.conf
      * commit: add a --add-file flag
      * mkcw: populate the rootfs using an overlay
      * chore(deps): update dependency containers/automation_images to v20230517
      * [skip-ci] Update actions/stale action to v9
      * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
      * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
      * Bump to v1.34.1-dev
      * Ignore errors if label.Relabel returns ENOSUP

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of moby-engine installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-41110 advisory.

  - Moby is an open-source project created by Docker for software containerization. A security vulnerability     has been detected in certain versions of Docker Engine, which could allow an attacker to bypass     authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is     low. Using a specially-crafted API request, an Engine API client could make the daemon forward the request     or response to an authorization plugin without the body. In certain circumstances, the authorization     plugin May allow a request which it would have otherwise denied if the body had been forwarded to it. A     security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially     crafted API request. This could lead to unauthorized actions, including privilege escalation. Although     this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later     major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the     request and/or response body to make access control decisions is potentially impacted. Docker EE v19.03.x     and all versions of Mirantis Container Runtime are not vulnerable. docker-ce v27.1.1 containes patches to     fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0,     and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or     restrict access to the Docker API to trusted parties, following the principle of least privilege.
    (CVE-2024-41110)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:2709-1 advisory.

    - Update to Docker 25.0.6-ce. See upstream changelog online at       <https://docs.docker.com/engine/release-notes/25.0/#2506>

    - CVE-2024-41110: A Authz zero length regression that could lead to authentication bypass was fixed     (bsc#1228324)

    - Fix BuildKit's symlink resolution logic to correctly handle non-lexical       symlinks. (bsc#1221916)
    - Write volume options atomically so sudden system crashes won't result in       future Docker starts failing due to empty files. (bsc#1214855)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-674 advisory.

    2024-08-28: CVE-2024-29018 was added to this advisory.

    2024-08-28: CVE-2024-24786 was added to this advisory.

    The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid     JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any     value, or when the UnmarshalOptions.DiscardUnknown option is set. (CVE-2024-24786)

    Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and     other distributions of container tooling or runtimes. Moby's networking implementation allows for many     networks, each with their own IP address range and gateway, to be defined. This feature is frequently     referred to as custom networks, as each network can have a different driver, set of parameters and thus     behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_.
    The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and     other API clients may specify the `internal` parameter as well.

    When containers with networking are created, they are assigned unique network interfaces and IP addresses.
    The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from     container IPs.

    Containers on an internal network may communicate between each other, but are precluded from communicating     with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall     rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus     appropriately configured host services) is possible, and the host may communicate with any container IP     directly.

    In addition to configuring the Linux kernel's various networking features to enable container networking,     `dockerd` directly provides some services to container networks. Principal among these is serving as a     resolver, enabling service discovery, and resolution of names from an upstream resolver.

    When a DNS request for a name that does not correspond to a container is received, the request is     forwarded to the configured upstream resolver. This request is made from the container's network     namespace: the level of access and routing of traffic is the same as if the request was made by the     container itself.

    As a consequence of this design, containers solely attached to an internal network will be unable to     resolve names using the upstream resolver, as the container itself is unable to communicate with that     nameserver. Only the names of containers also attached to the internal network are able to be resolved.

    Many systems run a local forwarding DNS resolver. As the host and any containers have separate loopback     devices, a consequence of the design described above is that containers are unable to resolve names from     the host's configured resolver, as they cannot reach these addresses on the host loopback device. To     bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver     is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the     host namework namespace. The loopback resolver then forwards the requests to its configured upstream     resolvers, as expected.

    Because `dockerd` forwards DNS requests to the host loopback device, bypassing the container network     namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to     an external nameserver. By registering a domain for which they control the authoritative nameservers, an     attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that     will eventually be answered by their nameservers.

    Docker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.

    Moby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal     networks. As a workaround, run containers intended to be solely attached to internal networks with a     custom upstream address, which will force all upstream DNS queries to be resolved from the container's     network namespace. (CVE-2024-29018)

    AWS is aware of CVE-2024-41110, an issue affecting the Moby open source project, packaged in Amazon Linux     as docker. Docker is a component of several open source container management systems.

    This issue does not affect the default configuration of docker. If an authorization plugin is enabled, a     specially-crafted API request to the docker daemon will be forwarded to the authorization plugin in a way     that could lead to unintended actions, such as privilege escalation. Enabling an authorization plugin is     an atypical configuration. The affected API endpoint is not exposed to the network in either the default,     typical, or recommended configurations. The default EKS and ECS configurations do not expose the API     endpoint to the network. Enabling a Docker authorization plugin is not supported when using ECS. Finally,     docker is not installed on EKS AMIs newer than 1.24. Although Docker is installed in EKS 1.24 and earlier,     EKS does not support authorization plugins.

    Updated docker packages addressing the issue are available for Amazon Linux 2 (docker-20.10.25-1.amzn2.0.5     and docker-25.0.6-1.amzn2.0.1) and for Amazon Linux 2023 (docker-25.0.6-1amzn2023.0.1). AWS recommends     that customers using docker upgrade to these or later versions. (CVE-2024-41110)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of docker installed on the remote host is prior to 25.0.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2024-040 advisory.

    2024-08-27: CVE-2024-29018 was added to this advisory.

    2024-08-27: CVE-2024-24786 was added to this advisory.

    The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid     JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any     value, or when the UnmarshalOptions.DiscardUnknown option is set. (CVE-2024-24786)

    Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and     other distributions of container tooling or runtimes. Moby's networking implementation allows for many     networks, each with their own IP address range and gateway, to be defined. This feature is frequently     referred to as custom networks, as each network can have a different driver, set of parameters and thus     behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_.
    The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and     other API clients may specify the `internal` parameter as well.

    When containers with networking are created, they are assigned unique network interfaces and IP addresses.
    The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from     container IPs.

    Containers on an internal network may communicate between each other, but are precluded from communicating     with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall     rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus     appropriately configured host services) is possible, and the host may communicate with any container IP     directly.

    In addition to configuring the Linux kernel's various networking features to enable container networking,     `dockerd` directly provides some services to container networks. Principal among these is serving as a     resolver, enabling service discovery, and resolution of names from an upstream resolver.

    When a DNS request for a name that does not correspond to a container is received, the request is     forwarded to the configured upstream resolver. This request is made from the container's network     namespace: the level of access and routing of traffic is the same as if the request was made by the     container itself.

    As a consequence of this design, containers solely attached to an internal network will be unable to     resolve names using the upstream resolver, as the container itself is unable to communicate with that     nameserver. Only the names of containers also attached to the internal network are able to be resolved.

    Many systems run a local forwarding DNS resolver. As the host and any containers have separate loopback     devices, a consequence of the design described above is that containers are unable to resolve names from     the host's configured resolver, as they cannot reach these addresses on the host loopback device. To     bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver     is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the     host namework namespace. The loopback resolver then forwards the requests to its configured upstream     resolvers, as expected.

    Because `dockerd` forwards DNS requests to the host loopback device, bypassing the container network     namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to     an external nameserver. By registering a domain for which they control the authoritative nameservers, an     attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that     will eventually be answered by their nameservers.

    Docker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.

    Moby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal     networks. As a workaround, run containers intended to be solely attached to internal networks with a     custom upstream address, which will force all upstream DNS queries to be resolved from the container's     network namespace. (CVE-2024-29018)

    AWS is aware of CVE-2024-41110, an issue affecting the Moby open source project, packaged in Amazon Linux     as docker. Docker is a component of several open source container management systems.

    This issue does not affect the default configuration of docker. If an authorization plugin is enabled, a     specially-crafted API request to the docker daemon will be forwarded to the authorization plugin in a way     that could lead to unintended actions, such as privilege escalation. Enabling an authorization plugin is     an atypical configuration. The affected API endpoint is not exposed to the network in either the default,     typical, or recommended configurations. The default EKS and ECS configurations do not expose the API     endpoint to the network. Enabling a Docker authorization plugin is not supported when using ECS. Finally,     docker is not installed on EKS AMIs newer than 1.24. Although Docker is installed in EKS 1.24 and earlier,     EKS does not support authorization plugins.

    Updated docker packages addressing the issue are available for Amazon Linux 2 (docker-20.10.25-1.amzn2.0.5     and docker-25.0.6-1.amzn2.0.1) and for Amazon Linux 2023 (docker-25.0.6-1amzn2023.0.1). AWS recommends     that customers using docker upgrade to these or later versions. (CVE-2024-41110)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of docker installed on the remote host is prior to 25.0.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2024-041 advisory.

    2024-08-27: CVE-2024-29018 was added to this advisory.

    2024-08-27: CVE-2024-24786 was added to this advisory.

    The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid     JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any     value, or when the UnmarshalOptions.DiscardUnknown option is set. (CVE-2024-24786)

    Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and     other distributions of container tooling or runtimes. Moby's networking implementation allows for many     networks, each with their own IP address range and gateway, to be defined. This feature is frequently     referred to as custom networks, as each network can have a different driver, set of parameters and thus     behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_.
    The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and     other API clients may specify the `internal` parameter as well.

    When containers with networking are created, they are assigned unique network interfaces and IP addresses.
    The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from     container IPs.

    Containers on an internal network may communicate between each other, but are precluded from communicating     with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall     rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus     appropriately configured host services) is possible, and the host may communicate with any container IP     directly.

    In addition to configuring the Linux kernel's various networking features to enable container networking,     `dockerd` directly provides some services to container networks. Principal among these is serving as a     resolver, enabling service discovery, and resolution of names from an upstream resolver.

    When a DNS request for a name that does not correspond to a container is received, the request is     forwarded to the configured upstream resolver. This request is made from the container's network     namespace: the level of access and routing of traffic is the same as if the request was made by the     container itself.

    As a consequence of this design, containers solely attached to an internal network will be unable to     resolve names using the upstream resolver, as the container itself is unable to communicate with that     nameserver. Only the names of containers also attached to the internal network are able to be resolved.

    Many systems run a local forwarding DNS resolver. As the host and any containers have separate loopback     devices, a consequence of the design described above is that containers are unable to resolve names from     the host's configured resolver, as they cannot reach these addresses on the host loopback device. To     bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver     is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the     host namework namespace. The loopback resolver then forwards the requests to its configured upstream     resolvers, as expected.

    Because `dockerd` forwards DNS requests to the host loopback device, bypassing the container network     namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to     an external nameserver. By registering a domain for which they control the authoritative nameservers, an     attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that     will eventually be answered by their nameservers.

    Docker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.

    Moby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal     networks. As a workaround, run containers intended to be solely attached to internal networks with a     custom upstream address, which will force all upstream DNS queries to be resolved from the container's     network namespace. (CVE-2024-29018)

    AWS is aware of CVE-2024-41110, an issue affecting the Moby open source project, packaged in Amazon Linux     as docker. Docker is a component of several open source container management systems.

    This issue does not affect the default configuration of docker. If an authorization plugin is enabled, a     specially-crafted API request to the docker daemon will be forwarded to the authorization plugin in a way     that could lead to unintended actions, such as privilege escalation. Enabling an authorization plugin is     an atypical configuration. The affected API endpoint is not exposed to the network in either the default,     typical, or recommended configurations. The default EKS and ECS configurations do not expose the API     endpoint to the network. Enabling a Docker authorization plugin is not supported when using ECS. Finally,     docker is not installed on EKS AMIs newer than 1.24. Although Docker is installed in EKS 1.24 and earlier,     EKS does not support authorization plugins.

    Updated docker packages addressing the issue are available for Amazon Linux 2 (docker-20.10.25-1.amzn2.0.5     and docker-25.0.6-1.amzn2.0.1) and for Amazon Linux 2023 (docker-25.0.6-1amzn2023.0.1). AWS recommends     that customers using docker upgrade to these or later versions. (CVE-2024-41110)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the Docker Engine (Moby) installed on the remote host is prior to 23.0.15, 26.x prior to 26.1.5 or 27.x prior to 27.1.1. It is therefore affected by an authentication bypass vulnerability. Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it. A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210248	EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2024-2785)	Nessus	Huawei Local Security Checks	critical
210245	EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2024-2797)	Nessus	Huawei Local Security Checks	critical
208930	Debian dla-3918 : docker-doc - security update	Nessus	Debian Local Security Checks	critical
208378	EulerOS 2.0 SP11 : docker-engine (EulerOS-SA-2024-2577)	Nessus	Huawei Local Security Checks	critical
208338	EulerOS 2.0 SP11 : docker-engine (EulerOS-SA-2024-2551)	Nessus	Huawei Local Security Checks	critical
207200	EulerOS 2.0 SP9 : docker-engine (EulerOS-SA-2024-2385)	Nessus	Huawei Local Security Checks	critical
207155	EulerOS 2.0 SP9 : docker-engine (EulerOS-SA-2024-2360)	Nessus	Huawei Local Security Checks	critical
207148	EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2024-2434)	Nessus	Huawei Local Security Checks	critical
207143	EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2024-2411)	Nessus	Huawei Local Security Checks	critical
206820	Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2024-2630)	Nessus	Amazon Linux Local Security Checks	medium
206817	Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2024-708)	Nessus	Amazon Linux Local Security Checks	medium
206635	Amazon Linux 2 : docker (ALASECS-2024-042)	Nessus	Amazon Linux Local Security Checks	critical
206581	SUSE SLES15 / openSUSE 15 Security Update : buildah, docker (SUSE-SU-2024:3120-1)	Nessus	SuSE Local Security Checks	critical
205050	CBL Mariner 2.0 Security Update: moby-engine (CVE-2024-41110)	Nessus	MarinerOS Local Security Checks	critical
204977	SUSE SLES12 Security Update : docker (SUSE-SU-2024:2709-1)	Nessus	SuSE Local Security Checks	critical
204957	Amazon Linux 2023 : docker (ALAS2023-2024-674)	Nessus	Amazon Linux Local Security Checks	critical
204943	Amazon Linux 2 : docker (ALASDOCKER-2024-040)	Nessus	Amazon Linux Local Security Checks	critical
204929	Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2024-041)	Nessus	Amazon Linux Local Security Checks	critical
204784	Docker Engine < 23.0.15 / 26.x < 26.1.5 / 27.x < 27.1.1 Authentication Bypass	Nessus	Misc.	critical

Detections

Analytics

CVE-2024-41110

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

medium

critical

critical

critical

critical

critical

critical

critical

critical