This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Docker Engine fixes a critical vulnerability
Docker Engine version v27.1.1 fixes a critical vulnerability. If updating is not possible, the company recommends avoiding the use of AuthZ plugins and restricting access to the Docker API to trusted parties in line with the principle of least privilege [1].
Allows an authenticated remote attacker to bypass an API request with the Content-Length set to 0, causing the Docker daemon to forward the request without a body to the AuthZ plugin, which may incorrectly approve the request [2] [1].
The vulnerability is present in product:
- Docker Engine; <=v19.03.15; <=v20.10.27; <=v23.0.14; <=v24.0.9; <=v25.0.5; <=v26.0.2; <=v26.1.4; <=v27.0.3; <=v27.1.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-41110 at cve.org, NVD
- CWE-187: Partial String Comparison at cwe.mitre.org
- CWE-444: Inconsistent Interpretation of HTTP Requests at cwe.mitre.org
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 23. 7. 2024.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 26. 7. 2024.