CVE-2024-41110

Publication date 24 July 2024

Last updated 18 December 2024

Ubuntu priority

High

Why this priority?

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low. Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it. A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted. Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable. docker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.

Read the notes from the security team

Why is this CVE high priority?

Upstream rates this as being high severity

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
docker.io 24.10 oracular
Not affected
24.04 LTS noble
Not affected
22.04 LTS jammy
Not affected
20.04 LTS focal
Not affected
18.04 LTS bionic
16.04 LTS xenial
Not affected
docker.io-app 24.10 oracular
Fixed 26.1.3-0ubuntu1.1
24.04 LTS noble
22.04 LTS jammy
Vulnerable
20.04 LTS focal
Vulnerable

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro

Notes

alexmurray

Traditionally the docker.io source package contained both the library and docker application. However, in releases that contain the docker.io-app source package, the docker.io source package contains only the library whilst the docker application itself is contained in the docker.io-app package.

sbeattie

docker packages contain an embedded copy of github:moby/buildkit

vyomydv

docker.io contains both the dev package and the application for bionic and older relelases. For focal and later, docker.io only contains the dev package which is not vulnerable. The docker application for focal and later is in docker.io-app.