Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): update module github.com/docker/docker to v26.1.5+incompatible [security] - autoclosed #593

Closed

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Aug 9, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
github.com/docker/docker v26.1.4+incompatible -> v26.1.5+incompatible age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-41110

A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low. This advisory outlines the issue, identifies the affected versions, and provides remediation steps for impacted users.

Impact

Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.

A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.

Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.

Vulnerability details

  • AuthZ bypass and privilege escalation: An attacker could exploit a bypass using an API request with Content-Length set to 0, causing the Docker daemon to forward the request without the body to the AuthZ plugin, which might approve the request incorrectly.
  • Initial fix: The issue was fixed in Docker Engine v18.09.1 January 2019..
  • Regression: The fix was not included in Docker Engine v19.03 or newer versions. This was identified in April 2024 and patches were released for the affected versions on July 23, 2024. The issue was assigned CVE-2024-41110.

Patches

  • docker-ce v27.1.1 containes patches to fix the vulnerability.
  • Patches have also been merged into the master, 19.0, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches.

Remediation steps

  • If you are running an affected version, update to the most recent patched version.
  • Mitigation if unable to update immediately:
    • Avoid using AuthZ plugins.
    • Restrict access to the Docker API to trusted parties, following the principle of least privilege.

References


Release Notes

docker/docker (github.com/docker/docker)

v26.1.5+incompatible

Compare Source


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner August 9, 2024 19:10
@renovate renovate bot added the dependencies Indicates a change to dependencies label Aug 9, 2024
Copy link

codecov bot commented Aug 9, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 57.46%. Comparing base (0593c8f) to head (da3e83e).
Report is 1 commits behind head on main.

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff           @@
##             main     #593   +/-   ##
=======================================
  Coverage   57.46%   57.46%           
=======================================
  Files         121      121           
  Lines        5205     5205           
=======================================
  Hits         2991     2991           
  Misses       1988     1988           
  Partials      226      226           

@renovate renovate bot force-pushed the renovate/go-github.com-docker-docker-vulnerability branch from 4b750e4 to ac84e36 Compare August 26, 2024 14:32
@renovate renovate bot force-pushed the renovate/go-github.com-docker-docker-vulnerability branch 2 times, most recently from 6011195 to 5c3536c Compare September 12, 2024 13:24
@renovate renovate bot force-pushed the renovate/go-github.com-docker-docker-vulnerability branch 3 times, most recently from 62d1861 to fdfe580 Compare September 20, 2024 15:17
@renovate renovate bot force-pushed the renovate/go-github.com-docker-docker-vulnerability branch from fdfe580 to da3e83e Compare September 20, 2024 15:24
@renovate renovate bot changed the title fix(deps): update module github.com/docker/docker to v26.1.5+incompatible [security] fix(deps): update module github.com/docker/docker to v26.1.5+incompatible [security] - autoclosed Sep 20, 2024
@renovate renovate bot closed this Sep 20, 2024
@renovate renovate bot deleted the renovate/go-github.com-docker-docker-vulnerability branch September 20, 2024 15:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Indicates a change to dependencies
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants