Docker vulnerabilities, page 4
125 vulnerabilities
Known vulnerabilities in Docker products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 43 products.
CVE-2014-5278debiandocker.io+1
EPSS score1.50%
A vulnerability exists in Docker before 1.2 via container names, which may collide with and override container IDs.CVE-2014-5277chainguarddocker+21EPSS score1.87%
Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.CVE-2014-5282debiandocker.io+2EPSS score1.32%
Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'.CVE-2014-6407chainguarddocker+19EPSS score4.91%
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.CVE-2014-6408debiandocker.io+2EPSS score3.14%
Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image.CVE-2014-8179debiandocker.io+6EPSS score2.73%
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.CVE-2014-8178debiandocker.io+6EPSS score0.49%
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.CVE-2014-3499chainguarddocker+19EPSS score0.39%
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.CVE-2022-26659dockerdocker_desktopEPSS score0.43%
Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by creating a symlink in place of where the installer writes its log file. Starting from version 4.6.0, the Docker Desktop installer, when run elevated, will write its log files to a location not writable by non-administrator users.CVE-2022-31647dockerdesktopEPSS score0.33%
Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in the DataFolder parameter, a different vulnerability than CVE-2022-26659.CVE-2022-25365dockerdockerEPSS score0.84%
Docker Desktop before 4.5.1 on Windows allows attackers to move arbitrary files. NOTE: this issue exists because of an incomplete fix for CVE-2022-23774.CVE-2022-37326dockerdesktopEPSS score0.30%
Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start API by controlling the pidfile field inside the DaemonJSON field in the WindowsContainerStartRequest class. This can indirectly lead to privilege escalation.CVE-2022-38730dockerdesktopEPSS score0.29%
Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by controlling the data-root field inside the DaemonJSON field in the WindowsContainerStartRequest class. This allows exploiting a symlink vulnerability in ..\dataRoot\network\files\local-kv.db because of a TOCTOU race condition.CVE-2022-34292dockerdesktopEPSS score0.34%
Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create dockerBackendV2 API by controlling the DataFolder parameter for DockerDesktop.vhdx, a similar issue to CVE-2022-31647.CVE-2022-23774dockerdocker_desktopEPSS score0.93%
Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files.CVE-2017-11468debiandocker-registry+9EPSS score3.19%
Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.CVE-2017-14992debiandocker.io+5EPSS score2.45%
Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.CVE-2024-9348dockerdocker_desktopEPSS score0.47%
Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view.CVE-2024-5652docker inc.docker desktop+1EPSS score0.37%
In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service through the exec-path Docker daemon config option in Windows containers mode.CVE-2024-6222docker inc.docker desktop+1EPSS score0.56%
In Docker Desktop before v4.29.0, an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages.
Docker Desktop v4.29.0 https://docs.docker.com/desktop/release-notes/#4290 fixes the issue on MacOS, Linux and Windows with Hyper-V backend.
As exploitation requires "Allow only extensions distributed through the Docker Marketplace" to be disabled, Docker Desktop v4.31.0 https://docs.docker.com/desktop/release-notes/#4310 additionally changes the default configuration to enable this setting by default.