GitHub Advisoryadvisory · Go

GHSA-qrqr-3x5j-2xw9 Docker Authentication Bypass

HIGH Published 2024-01-31 Modified 2024-07-08 Official page ↗
Aliases
CVE-2018-12608
Ecosystem
Go
Packages
github.com/docker/docker
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-288
Reviewed
2024-01-31

Affected packages

• Go github.com/docker/docker: < 17.06.0-ce → fixed in 17.06.0-ce

Description

An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA (as opposed to one signed by the configured CA root certificate) to authenticate.

Related

Alias · CVE (1)

  • CVE-2018-12608 An issue was discovered in Docker Moby before 17.06.0. vulnerability

Weakness · CWE (1)

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness

References