CVE-2024-41110

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low.

Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.

A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.

Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.

docker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low. Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it. A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted. Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable. docker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.

A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low. This advisory outlines the issue, identifies the affected versions, and provides remediation steps for impacted users.

Impact

Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.

A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.

Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.

Vulnerability details

• AuthZ bypass and privilege escalation: An attacker could exploit a bypass using an API request with Content-Length set to 0, causing the Docker daemon to forward the request without the body to the AuthZ plugin, which might approve the request incorrectly.
• Initial fix: The issue was fixed in Docker Engine v18.09.1 January 2019..
• Regression: The fix was not included in Docker Engine v19.03 or newer versions. This was identified in April 2024 and patches were released for the affected versions on July 23, 2024. The issue was assigned CVE-2024-41110.

Patches

• docker-ce v27.1.1 containes patches to fix the vulnerability.
• Patches have also been merged into the master, 19.0, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches.

Remediation steps

• If you are running an affected version, update to the most recent patched version.
• Mitigation if unable to update immediately:
  • Avoid using AuthZ plugins.
  • Restrict access to the Docker API to trusted parties, following the principle of least privilege.

References

• https://github.com/moby/moby/commit/fc274cd2ff4cf3b48c91697fb327dd1fb95588fb
• https://github.com/moby/moby/commit/a79fabbfe84117696a19671f4aa88b82d0f64fc1
• https://www.docker.com/blog/docker-security-advisory-docker-engine-authz-plugin/

Docker is an open source project to build, ship and run any application as a lightweight container.

Security Fix(es):

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low.

Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.

A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.

Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.

docker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.(CVE-2024-41110)

Docker is a product for you to build, ship and run any application as a lightweight container.

Security Fix(es):

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low.

Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.

A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.

Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.

docker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.(CVE-2024-41110)

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low. Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it. A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted. Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable. docker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low.

Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.

A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.

Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.

docker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low.

Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.

A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.

Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.

docker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.

Moby authz zero length regression in github.com/moby/moby

These are all security issues fixed in the docker-26.1.5_ce-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the nova-3.10.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the docker-stable-24.0.9_ce-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the apptainer-1.3.6-5.1 package on the GA media of openSUSE Tumbleweed.

This update for apptainer fixes the following issues:

Changes in apptainer:

• Fix CVE-2026-34986 (bsc#1262956) * github.com/go-jose/go-jose/[email protected] CVE-2026-33186 GO-2026-4762 (bsc#1260311) * google.golang.org/[email protected] CVE-2026-24137 GO-2026-4358 (bsc#1264177) * github.com/sigstore/[email protected] Fix fallout: github.com/moby/[email protected] github.com/containers/image/v5=github.com/containers/image/[email protected]

• Fix HTML parser misimplementation of a part of the HTML specification for table related tags (CVE-2025-58190, GO-2026-4441, bsc#1258048).

• Fix issue where the HTML parser takes a very long time or even never returns (CVE-2025-47911, GO-2026-4440, bsc#1258047).

• Update ot 1.4.5

  • Fix for moderate severity GO-2025-4176 / CVE-2025-65105 / GHSA-j3rw-fx6g-q46j (bsc#1255462): Ineffective application of selinux / apparmor --security option. Updates of a few dependent go libraries for related security fixes.
  • Other fix Run FUSE processes in a separate process group. This detaches them from the main process so they don't receive signals such as interrupts sent to a terminal there. This was not a problem with interactive shells because they start their own group, but was a problem with some programs with interactive Read/Eval/Print/Loops such as python. An interrupt there would kill the FUSE processes.

• From 1.4.4

  • By applying patches to the bundled fuse2fs, allow again the possibility of using a non-writable ext3 image file as an overlay. Fixes regression introduced in 1.4.3.
  • If an overlay or bound data image is asked to be mounted writable but the user has no write access to the image, show a warning message instead of silently switching to readonly.
  • Avoid a fatal error when starting fakeroot from suid mode while in an NFS directory.
  • Fix 32-bit builds which were accidentally broken by a library upgrade that was done for a minor security issue.

• Fix CVEs:

  • GO-2025-4135 - CVE-2025-47914 Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent.
  • GO-2025-4134 - CVE-2025-58181 - bsc#1253924 Unbounded memory consumption in golang.org/x/crypto/ssh.
  • GO-2025-4116 - CVE-2025-47913 Potential denial of service in golang.org/x/crypto/ssh/agent.
  • GO-2025-3595 - CVE-2025-22872 Incorrect Neutralization of Input During Web Page Generation in x/net.
  • GO-2025-3503 - CVE-2025-22870 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net.
  • GO-2025-3487 - CVE-2025-22869 Potential denial of service in golang.org/x/crypto.
  • GO-2025-3485 - CVE-2025-27144 DoS in go-jose Parsing in github.com/go-jose/go-jose.
  • GO-2025-3754 - CVE-2025-8556 CIRCL-Fourq: Missing and wrong validation can lead to incorrect results in github.com/cloudflare/circl.

• No need for binutils-gold for aarch64

• Update to 1.4.3

  • Corrected the mconfig -s option for statically building apptainer and starter binaries.
  • Resolved an issue where the Makefile generated by mconfig -b failed when the build directory was not a subdirectory of the Apptainer source code.
  • Fixed %files in definition files to correctly copy symlinks pointing above the destination directory but within the destination stage root filesystem.
  • Addressed a typo in nvliblist.conf ( libnvoptix.so.1 was corrected to libnvoptix.so).
  • Prevented timeouts during cleanup after building gocryptfs-encrypted SIF files.
  • Fixed a bug that prevented build with --passphrase or --pem-path (without --encrypt) from implying fakeroot.
  • Resolved a hang when copying files between build stages while using suid mode without user namespaces.
  • Fixed issues with running and building containers of different architectures than the host via binfmt_misc when using rootless fakeroot.
  • Corrected "target: no such file or directory" errors when …

This update for docker-stable fixes the following issues:

• Update docker-buildx to v0.19.2. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.19.2. Some notable changelogs from the last update:

  • https://github.com/docker/buildx/releases/tag/v0.19.0
  • https://github.com/docker/buildx/releases/tag/v0.18.0

• Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999 In order to disable these mounts, just do echo 0 > /etc/docker/suse-secrets-enable and restart Docker. In order to re-enable them, just do echo 1 > /etc/docker/suse-secrets-enable and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not.

This update for docker fixes the following issues:

• Update to Docker 25.0.6-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/25.0/#2506

• CVE-2024-41110: A Authz zero length regression that could lead to authentication bypass was fixed (bsc#1228324)

• Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. (bsc#1221916)

• Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. (bsc#1214855)

This update for buildah, docker fixes the following issues:

Changes in docker:

• CVE-2024-23651: Fixed arbitrary files write due to race condition on mounts (bsc#1219267)
• CVE-2024-23652: Fixed insufficient validation of parent directory on mount (bsc#1219268)
• CVE-2024-23653: Fixed insufficient validation on entitlement on container creation via buildkit (bsc#1219438)
• CVE-2024-41110: A Authz zero length regression that could lead to authentication bypass was fixed (bsc#1228324)

Other fixes:

• Update to Docker 25.0.6-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/25.0/#2506

• Update to Docker 25.0.5-ce (bsc#1223409)

• Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. (bsc#1221916)

• Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. (bsc#1214855)

Changes in buildah:

• Update to version 1.35.4:

  • [release-1.35] Bump to Buildah v1.35.4
  • [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  • integration test: handle new labels in 'bud and test --unsetlabel'
  • [release-1.35] Bump go-jose CVE-2024-28180
  • [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180

• Update to version 1.35.3:

  • [release-1.35] Bump to Buildah v1.35.3
  • [release-1.35] correctly configure /etc/hosts and resolv.conf
  • [release-1.35] buildah: refactor resolv/hosts setup.
  • [release-1.35] rename the hostFile var to reflect
  • [release-1.35] Bump c/common to v0.58.1
  • [release-1.35] Bump Buildah to v1.35.2
  • [release-1.35] CVE-2024-24786 protobuf to 1.33
  • [release-1.35] Bump to v1.35.2-dev

• Update to version 1.35.1:

  • [release-1.35] Bump to v1.35.1
  • [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)

• Buildah dropped cni support, require netavark instead (bsc#1221243)

• Remove obsolete requires libcontainers-image & libcontainers-storage

• Require passt for rootless networking (poo#156955) Buildah moved to passt/pasta for rootless networking from slirp4netns (https://github.com/containers/common/pull/1846)

• Update to version 1.35.0:

  • Bump v1.35.0
  • Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  • conformance tests: don't break on trailing zeroes in layer blobs
  • Add a conformance test for copying to a mounted prior stage
  • fix(deps): update module github.com/stretchr/testify to v1.9.0
  • cgroups: reuse version check from c/common
  • Update vendor of containers/(common,image)
  • fix(deps): update github.com/containers/storage digest to eadc620
  • fix(deps): update github.com/containers/luksy digest to ceb12d4
  • fix(deps): update github.com/containers/image/v5 digest to cdc6802
  • manifest add: complain if we get artifact flags without --artifact
  • Use retry logic from containers/common
  • Vendor in containers/(storage,image,common)
  • Update module golang.org/x/crypto to v0.20.0
  • Add comment re: Total Success task name
  • tests: skip_if_no_unshare(): check for --setuid
  • Properly handle build --pull=false
  • [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  • Update module go.etcd.io/bbolt to v1.3.9
  • Revert 'Reduce official image size'
  • Update module github.com/opencontainers/image-spec to v1.1.0
  • Reduce official image size
  • Build with CNI support on FreeBSD
  • build --all-platforms: skip some base 'image' platforms
  • Bump main to v1.35.0-dev
  • Vendor in latest containers/(storage,image,common)
  • Split up error messages for missing --sbom related flags
  • buildah manifest: add artifact-related options
  • cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  • cmd/buildah/manifest.go: don't make struct declarations aliases
  • Use golang.org/x/exp/slices.Contains
  • Disable loong64 again
  • Fix a couple of typos in one-line comments
  • egrep is obsolescent; use grep -E
  • Try Cirrus with a newer VM version
  • Set CONTAINERS_CONF in the chroot-mount-flags…

This update for docker-stable fixes the following issues:

• CVE-2024-41110: Fixed Authz zero length regression (bsc#1228324).

Bug fixes:

• Allow users to disable SUSE secrets support by setting DOCKER_SUSE_SECRETS_ENABLE=0 in /etc/sysconfig/docker (bsc#1231348).
• Import specfile changes for docker-buildx as well as the changes to help reduce specfile differences between docker-stable and docker (bsc#1230331, bsc#1230333).
• Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks (bsc#1221916).
• Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files (bsc#1214855).

This update for docker-stable fixes the following issues:

• Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases.

• Update --add-runtime to point to correct binary path.

• Further merge docker and docker-stable specfiles to minimise the differences. The main thing is that we now include both halves of the Conflicts/Provides/Obsoletes dance in both specfiles.

• Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.17.1

• Allow users to disable SUSE secrets support by setting DOCKER_SUSE_SECRETS_ENABLE=0 in /etc/sysconfig/docker. bsc#1231348

• Import specfile changes for docker-buildx as well as the changes to help reduce specfile differences between docker-stable and docker. bsc#1230331 bsc#1230333

• Backport patch for CVE-2024-41110. bsc#1228324

• Initial docker-stable release, forked from Docker 24.0.6-ce release (packaged on 2023-10-11).

• Update to Docker 24.0.9-ce, which is the latest version of the 24.0.x branch. It seems likely this will be the last upstream version of the 24.0.x branch (it seems Mirantis is going to do LTS for 23.0.x, not 24.0.x). https://docs.docker.com/engine/release-notes/24.0/#2409

• Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of https://github.com/moby/buildkit/pull/4896 and https://github.com/moby/buildkit/pull/5060. bsc#1221916

• Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of https://github.com/moby/moby/pull/48034. bsc#1214855

This update for docker fixes the following issues:

• Update docker-buildx to v0.19.2. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.19.2.

  Some notable changelogs from the last update:

  • https://github.com/docker/buildx/releases/tag/v0.19.0
  • https://github.com/docker/buildx/releases/tag/v0.18.0

• Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999

  In order to disable these mounts, just do

  echo 0 > /etc/docker/suse-secrets-enable

  and restart Docker. In order to re-enable them, just do

  echo 1 > /etc/docker/suse-secrets-enable

  and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not.

• Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819

• Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases.

• Allow a parallel docker-stable RPM to exists in repositories.

• Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.17.1

• Allow users to disable SUSE secrets support by setting DOCKER_SUSE_SECRETS_ENABLE=0 in /etc/sysconfig/docker. (bsc#1231348)

• Mark docker-buildx as required since classic 'docker build' has been deprecated since Docker 23.0. (bsc#1230331)

• Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate package, but with docker-stable it will be necessary to maintain the packages together and it makes more sense to have them live in the same OBS package. (bsc#1230333)

• Update to Docker 26.1.5-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2615 bsc#1230294

• This update includes fixes for:

  • CVE-2024-41110. bsc#1228324
  • CVE-2023-47108. bsc#1217070 bsc#1229806
  • CVE-2023-45142. bsc#1228553 bsc#1229806

• Update to Docker 26.1.4-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2614

• Update to Docker 26.1.0-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2610

• Update --add-runtime to point to correct binary path.

This update for docker fixes the following issues:

• Update docker-buildx to v0.19.2. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.19.2.

  Some notable changelogs from the last update:

  • https://github.com/docker/buildx/releases/tag/v0.19.0
  • https://github.com/docker/buildx/releases/tag/v0.18.0

• Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999

  In order to disable these mounts, just do

  echo 0 > /etc/docker/suse-secrets-enable

  and restart Docker. In order to re-enable them, just do

  echo 1 > /etc/docker/suse-secrets-enable

  and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not.

• Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819

• Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases.

• Allow a parallel docker-stable RPM to exists in repositories.

• Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.17.1

• Allow users to disable SUSE secrets support by setting DOCKER_SUSE_SECRETS_ENABLE=0 in /etc/sysconfig/docker. (bsc#1231348)

• Mark docker-buildx as required since classic 'docker build' has been deprecated since Docker 23.0. (bsc#1230331)

• Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate package, but with docker-stable it will be necessary to maintain the packages together and it makes more sense to have them live in the same OBS package. (bsc#1230333)

• Update to Docker 26.1.5-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2615 bsc#1230294

• This update includes fixes for:

  • CVE-2024-41110. bsc#1228324
  • CVE-2023-47108. bsc#1217070 bsc#1229806
  • CVE-2023-45142. bsc#1228553 bsc#1229806

• Update to Docker 26.1.4-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2614

• Update to Docker 26.1.0-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2610

• Update --add-runtime to point to correct binary path.

This update for docker-stable fixes the following issues:

• CVE-2024-29018: Fixed external DNS request handling from 'internal' networks that could have led to data exfiltration (bsc#1234089).
• CVE-2024-23650: Fixed possibile BuildKit daemon crash via malicious BuildKit client or frontend request (bsc#1219437).

This update for docker-stable fixes the following issues:

• Include historical changelog data from before the docker-stable fork. The initial changelog entry did technically provide all the necessary information, but our CVE tracking tools do not understand how the package is forked and so it seems that this package does not include fixes for ~12 years of updates. So, include a copy of the original package's changelog up until the fork point. (bsc#1250596)

• Remove git-core recommends on SLE. Most SLE systems have installRecommends=yes by default and thus end up installing git with Docker. bsc#1250508

  This feature is mostly intended for developers ('docker build git://') so most users already have the dependency installed, and the error when git is missing is fairly straightforward (so they can easily figure out what they need to install).

• Backport https://github.com/moby/moby/pull/48517. bsc#1247362

• Update to docker-buildx v0.25.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.25.0

• Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as Docker does not have permission to access the host zypper credentials in this mode (and unprivileged users cannot disable the feature using /etc/docker/suse-secrets-enable.) bsc#1240150

• Initial docker-stable fork, forked from Docker 24.0.7-ce release (packaged on 2024-02-14). The original changelog is included below for historical reference.

This update for docker-stable fixes the following issues:

Note this update contains a already fixed references mostly.

• Remove git-core recommends on SLE to avoid pulling it in unnecessary. (bsc#1250508)

  This feature is mostly intended for developers ('docker build git://') so most users already have the dependency installed, and the error when git is missing is fairly straightforward (so they can easily figure out what they need to install).

• Include historical changelog data from before the docker-stable fork. The initial changelog entry did technically provide all the necessary information, but our CVE tracking tools do not understand how the package is forked and so it seems that this package does not include fixes for ~12 years of updates. So, include a copy of the original package's changelog up until the fork point. bsc#1250596

• Update to docker-buildx v0.25.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.25.0

• Update to Go 1.23 for building now that upstream has switched their 23.0.x LTSS to use Go 1.23.

• Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as Docker does not have permission to access the host zypper credentials in this mode (and unprivileged users cannot disable the feature using /etc/docker/suse-secrets-enable.) bsc#1240150

• Initial docker-stable fork, forked from Docker 24.0.7-ce release (packaged on 2024-02-14). The original changelog is included below for historical reference.

This update for apptainer fixes the following issues:

• CVE-2025-27144: Fixed Denial of Service in Go JOSE's Parsing (bsc#1237679).
• CVE-2024-45338: Fixed denial of service due to non-linear parsing of case-insensitive content (bsc#1234794).
• CVE-2024-45337: Fixed Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (bsc#1234595).
• CVE-2025-22870: Fixed proxy bypass using IPv6 zone IDs (bsc#1238611).
• CVE-2025-22869: Fixed Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239341).
• CVE-2024-41110: Fixed Authz zero length regression (bsc#1228324).

This update for docker, docker-stable fixes the following issues:

• CVE-2025-22868: Fixed unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239185).
• CVE-2025-22869: Fixed Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).

Other fixes:

• Make container-selinux requirement conditional on selinux-policy (bsc#1237367)

This update for docker, docker-stable fixes the following issues:

• CVE-2025-22868: Fixed unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239185).
• CVE-2025-22869: Fixed Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).
• CVE-2024-29018: Fixed external DNS requests from 'internal' networks leading to data exfiltration (bsc#1234089).
• CVE-2024-23650: Fixed BuildKit daemon crash via malicious BuildKit client or frontend request (bsc#1219437).

Other fixes:

• Make container-selinux requirement conditional on selinux-policy (bsc#1237367).
• Updated docker-buildx to 0.19.3.

This update for docker fixes the following issues:

Security fixes:

• CVE-2024-23651: Fixed arbitrary files write due to race condition on mounts (bsc#1219267)
• CVE-2024-23652: Fixed insufficient validation of parent directory on mount (bsc#1219268)
• CVE-2024-23653: Fixed insufficient validation on entitlement on container creation via buildkit (bsc#1219438)
• CVE-2024-41110: A Authz zero length regression that could lead to authentication bypass was fixed (bsc#1228324)

Other changes:

• Update to Docker 25.0.6-ce.
• Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. (bsc#1221916)
• Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. (bsc#1214855)
• Fixed world writable docker overlay files (bsc#1220339)

This update for docker fixes the following issues:

• Update docker-buildx to v0.19.2. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.19.2.

  Some notable changelogs from the last update:

  • https://github.com/docker/buildx/releases/tag/v0.19.0
  • https://github.com/docker/buildx/releases/tag/v0.18.0

• Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999

  In order to disable these mounts, just do

  echo 0 > /etc/docker/suse-secrets-enable

  and restart Docker. In order to re-enable them, just do

  echo 1 > /etc/docker/suse-secrets-enable

  and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not.

• Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases.

• Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.17.1

• Add %{_sysconfdir}/audit/rules.d to filelist.

• Update to Docker 26.1.5-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2615 bsc#1230294

• This update includes fixes for:

  • CVE-2024-41110. bsc#1228324
  • CVE-2023-47108. bsc#1217070
  • CVE-2023-45142. bsc#1228553

This update for docker fixes the following issues:

• This update includes fixes for:

  • CVE-2024-41110: Fixed Authz zero length regression (bsc#1228324)
  • CVE-2023-47108: Fixed otelgrpc: DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality (bsc#1217070 bsc#1229806)
  • CVE-2023-45142: Fixed otelhttp,otelhttptrace,otelrestful: DoS vulnerability (bsc#1228553 bsc#1229806)

• Update to Docker 27.5.1-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/27/#2741 bsc#1237335

• Update to docker-buildx 0.20.1. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.20.1

• Update to Docker 27.4.1-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/27/#2741

• Update to docker-buildx 0.19.3. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.19.3

• Update to Docker 27.4.0-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/27/#274

  https://github.com/docker/buildx/releases/tag/v0.19.2.

  Some notable changelogs from the last update:

  • https://github.com/docker/buildx/releases/tag/v0.19.0
  • https://github.com/docker/buildx/releases/tag/v0.18.0

• Update to Go 1.22.

• Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999

  In order to disable these mounts, just do

  echo 0 > /etc/docker/suse-secrets-enable

  and restart Docker. In order to re-enable them, just do

  echo 1 > /etc/docker/suse-secrets-enable

  and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not.

• Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819

• Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases.

• Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.17.1

• Mark docker-buildx as required since classic "docker build" has been deprecated since Docker 23.0. bsc#1230331

• Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate package, but with docker-stable it will be necessary to maintain the packages together and it makes more sense to have them live in the same OBS package. bsc#1230333

• Update to Docker 26.1.5-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2615 bsc#1230294

This update for docker-stable fixes the following issues:

• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253904).

This update for docker-stable fixes the following issues:

• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253904).

Yair Zak discovered that Docker could unexpectedly forward DNS requests from internal networks in an unexpected manner. An attacker could possibly use this issue to exfiltrate data by encoding information in DNS queries to controlled nameservers. This issue was only addressed for the source package docker.io-app in Ubuntu 24.04 LTS. (CVE-2024-29018)

Cory Snider discovered that Docker did not properly handle authorization plugin request processing. An attacker could possibly use this issue to bypass authorization controls by forwarding API requests without their full body, leading to unauthorized actions. This issue was only addressed for the source package docker.io-app in Ubuntu 24.10 and Ubuntu 24.04 LTS, and the source package docker.io in Ubuntu 18.04 LTS. (CVE-2024-41110)

USN-7161-1 fixed CVE-2024-29018 in Ubuntu 24.04 LTS. This update fixes it for source package docker.io in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and source package docker.io-app for Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.

USN-7161-1 fixed CVE-2024-41110 in Ubuntu 24.10, Ubuntu 24.04 LTS, and Ubuntu 18.04 LTS. This update fixes it for source package docker.io-app in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.

Original advisory details:

Yair Zak discovered that Docker could unexpectedly forward DNS requests from internal networks in an unexpected manner. An attacker could possibly use this issue to exfiltrate data by encoding information in DNS queries to controlled nameservers. This issue was only addressed for the source package docker.io-app in Ubuntu 24.04 LTS. (CVE-2024-29018)

Cory Snider discovered that Docker did not properly handle authorization plugin request processing. An attacker could possibly use this issue to bypass authorization controls by forwarding API requests without their full body, leading to unauthorized actions. This issue was only addressed for the source package docker.io-app in Ubuntu 24.10 and Ubuntu 24.04 LTS, and the source package docker.io in Ubuntu 18.04 LTS. (CVE-2024-41110)

USN-7161-1 and USN-7161-2 fixed CVE-2024-41110 for source package docker.io in Ubuntu 18.04 LTS and for source package docker.io-app in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 24.10. This update fixes it for source package docker.io in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 24.10. These updates only address the docker library and not the docker.io application itself, which was already patched in the previous USNs (USN-7161-1 and USN-7161-2).

Original advisory details:

Yair Zak discovered that Docker could unexpectedly forward DNS requests from internal networks in an unexpected manner. An attacker could possibly use this issue to exfiltrate data by encoding information in DNS queries to controlled nameservers. This issue was only addressed for the source package docker.io-app in Ubuntu 24.04 LTS. (CVE-2024-29018)

Cory Snider discovered that Docker did not properly handle authorization plugin request processing. An attacker could possibly use this issue to bypass authorization controls by forwarding API requests without their full body, leading to unauthorized actions. This issue was only addressed for the source package docker.io-app in Ubuntu 24.10 and Ubuntu 24.04 LTS, and the source package docker.io in Ubuntu 18.04 LTS. (CVE-2024-41110)