CVE-2025-54388
Moby's Firewalld reload makes published container ports accessible from remote hosts
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Moby's Firewalld reload makes published container ports accessible from remote hosts
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.
- Record
CVE-2025-54388- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-909
- Updated
- 2026-11-02
EUVDEUVD-2025-23167
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.
- Record
EUVD-2025-23167- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x4rx-4gw3-53p4
Moby firewalld reload makes published container ports accessible from remote hosts
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (dockerd), which is developed as moby/moby is commonly referred to as Docker, or Docker Engine.
Firewalld is a daemon used by some Linux distributions to provide a dynamically managed firewall. When Firewalld is running, Docker uses its iptables backend to create rules, including rules to isolate containers in one bridge network from containers in other bridge networks.
Impact
The iptables rules created by Docker are removed when firewalld is reloaded using, for example "firewall-cmd --reload", "killall -HUP firewalld", or "systemctl reload firewalld".
When that happens, Docker must re-create the rules. However, in affected versions of Docker, the iptables rules that prevent packets arriving on a host interface from reaching container addresses are not re-created.
Once these rules have been removed, a remote host configured with a route to a Docker bridge network can access published ports, even when those ports were only published to a loopback address. Unpublished ports remain inaccessible.
For example, following a firewalld reload on a Docker host with address 192.168.0.10 and a bridge network with subnet 172.17.0.0/16, running the following command on another host in the local network will give it access to published ports on container addresses in that network: ip route add 172.17.0.0/16 via 192.168.0.10.
Containers running in networks created with --internal or equivalent have no access to other networks. Containers that are only connected to these networks remain isolated after a firewalld reload.
Where Docker Engine is not running in the host's network namespace, it is unaffected. Including, for example, Rootless Mode, and Docker Desktop.
Patches
Moby releases older than 28.2.0 are not affected. A fix is available in moby release 28.3.3.
Workarounds
After reloading firewalld, either:
- Restart the docker daemon,
- Re-create bridge networks, or
- Use rootless mode.
References
https://firewalld.org/ https://firewalld.org/documentation/howto/reload-firewalld.html
- Record
GHSA-x4rx-4gw3-53p4- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-909
- Updated
- 2026-11-02
NVD
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.
- Record
CVE-2025-54388- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-909
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-54388
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.
- Record
ALPINE-CVE-2025-54388- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
OSVBELL-CVE-2025-54388
- Record
BELL-CVE-2025-54388- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Show 14 moreShow less
OSV
Moby's Firewalld reload makes published container ports accessible from remote hosts
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.
- Record
CVE-2025-54388- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-909
- Updated
- 2026-11-02
OSVGHSA-x4rx-4gw3-53p4
Moby firewalld reload makes published container ports accessible from remote hosts
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (dockerd), which is developed as moby/moby is commonly referred to as Docker, or Docker Engine.
Firewalld is a daemon used by some Linux distributions to provide a dynamically managed firewall. When Firewalld is running, Docker uses its iptables backend to create rules, including rules to isolate containers in one bridge network from containers in other bridge networks.
Impact
The iptables rules created by Docker are removed when firewalld is reloaded using, for example "firewall-cmd --reload", "killall -HUP firewalld", or "systemctl reload firewalld".
When that happens, Docker must re-create the rules. However, in affected versions of Docker, the iptables rules that prevent packets arriving on a host interface from reaching container addresses are not re-created.
Once these rules have been removed, a remote host configured with a route to a Docker bridge network can access published ports, even when those ports were only published to a loopback address. Unpublished ports remain inaccessible.
For example, following a firewalld reload on a Docker host with address 192.168.0.10 and a bridge network with subnet 172.17.0.0/16, running the following command on another host in the local network will give it access to published ports on container addresses in that network: ip route add 172.17.0.0/16 via 192.168.0.10.
Containers running in networks created with --internal or equivalent have no access to other networks. Containers that are only connected to these networks remain isolated after a firewalld reload.
Where Docker Engine is not running in the host's network namespace, it is unaffected. Including, for example, Rootless Mode, and Docker Desktop.
Patches
Moby releases older than 28.2.0 are not affected. A fix is available in moby release 28.3.3.
Workarounds
After reloading firewalld, either:
- Restart the docker daemon,
- Re-create bridge networks, or
- Use rootless mode.
References
https://firewalld.org/ https://firewalld.org/documentation/howto/reload-firewalld.html
- Record
GHSA-x4rx-4gw3-53p4- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-909
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-54388
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.
- Record
UBUNTU-CVE-2025-54388- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGO-2025-3830 No score
Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker
Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker
- Record
GO-2025-3830- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15395-1 No score
docker-28.3.3_ce-26.1 on GA media
These are all security issues fixed in the docker-28.3.3_ce-26.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15395-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15434-1 No score
govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250811T192933-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15434-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20057-1 No score
Security update for docker
This update for docker fixes the following issues:
Changes in docker:
-
Update to Docker 28.5.1-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/28/#2851
-
Update to Docker 28.5.0-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/28/#2850
-
Update to docker-buildx v0.29.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.29.0
-
Remove git-core recommends on SLE. Most SLE systems have installRecommends=yes by default and thus end up installing git with Docker. bsc#1250508
This feature is mostly intended for developers ("docker build git://") so most users already have the dependency installed, and the error when git is missing is fairly straightforward (so they can easily figure out what they need to install).
-
Update to docker-buildx v0.28.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.28.0
-
Update to Docker 28.4.0-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/28/#2840
- Fixes a nil pointer panic in "docker push". bsc#1248373
-
Update warnings and errors related to "docker buildx ..." so that they reference our openSUSE docker-buildx packages.
-
Enable building docker-buildx for SLE15 systems with SUSEConnect secret injection enabled. PED-12534 PED-8905 bsc#1247594
As docker-buildx does not support our SUSEConnect secret injection (and some users depend "docker build" working transparently), patch the docker CLI so that "docker build" will no longer automatically call "docker buildx build", effectively making DOCKER_BUILDKIT=0 the default configuration. Users can manually use "docker buildx ..." commands or set DOCKER_BUILDKIT=1 in order to opt-in to using docker-buildx.
Users can silence the "docker build" warning by setting DOCKER_BUILDKIT=0 explicitly.
In order to inject SCC credentials with docker-buildx, users should use
RUN --mount=type=secret,id=SCCcredentials zypper -n ...
in their Dockerfiles, and
docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
when doing their builds.
-
Update to Docker 28.3.3-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/28/#2833 CVE-2025-54388 bsc#1247367
-
Update to docker-buildx v0.26.1. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.26.1
-
Update to docker-buildx v0.26.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.26.0
- Record
openSUSE-SU-2026:20057-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02912-1 No score
Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues:
-
Update to version 0.0.20250814T182633 2025-08-14T18:26:33Z (jsc#PED-11136)
Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2025-3765 CVE-2024-44906 GHSA-h4h6-vccr-44h2
- GO-2025-3829 CVE-2025-54410 GHSA-4vq8-7jfc-9cvp
-
Update to version 0.0.20250811T192933 2025-08-11T19:29:33Z (jsc#PED-11136)
Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2025-3822 CVE-2025-53942 GHSA-9g4j-v8w5-7x42
- GO-2025-3829 CVE-2025-54410 GHSA-4vq8-7jfc-9cvp
- GO-2025-3830 CVE-2025-54388 GHSA-x4rx-4gw3-53p4
- GO-2025-3831 CVE-2025-50738 GHSA-hfcf-79gh-f3jc
- GO-2025-3832 CVE-2021-21411 GHSA-652x-m2gr-hppm
- GO-2025-3833 CVE-2025-54576 GHSA-7rh7-c77v-6434
- GO-2025-3834 CVE-2025-54424 GHSA-8j63-96wh-wh3j
- GO-2025-3835 CVE-2025-54386 GHSA-q6gg-9f92-r9wg
- GO-2025-3836 CVE-2025-6037 GHSA-6c5r-4wfc-3mcx
- GO-2025-3837 CVE-2025-5999 GHSA-6h4p-m86h-hhgh
- GO-2025-3838 CVE-2025-6000 GHSA-mr4h-qf9j-f665
- GO-2025-3839 CVE-2025-6011 GHSA-mwgr-84fv-3jh9
- GO-2025-3840 CVE-2025-6004 GHSA-qgj7-fmq2-6cc4
- GO-2025-3841 CVE-2025-6014 GHSA-qv3p-fmv3-9hww
- GO-2025-3842 CVE-2025-6015 GHSA-v6r4-35f9-9rpw
- GO-2025-3843 CVE-2025-8341 GHSA-3c93-92r7-j934
- GO-2025-3844 CVE-2025-53534 GHSA-fm3m-jrgm-5ppg
- GO-2025-3845 CVE-2025-54801 GHSA-qx2q-88mx-vhg7
- GO-2025-3847 CVE-2025-54799 GHSA-q82r-2j7m-9rv4
- GO-2025-3848 CVE-2025-6013 GHSA-7rx2-769v-hrwf
- GO-2025-3851 CVE-2025-44779 GHSA-93jv-pvg8-hf3v
- GO-2025-3852 CVE-2025-7195 GHSA-856v-8qm2-9wjv
- GO-2025-3853 CVE-2025-55000 GHSA-f7c3-mhj2-9pvg
- GO-2025-3854 CVE-2025-54999 GHSA-hh28-h22f-8357
- GO-2025-3855 CVE-2025-54998 GHSA-j3xv-7fxp-gfhx
- GO-2025-3856 CVE-2025-55003 GHSA-rxp7-9q75-vj3p
- GO-2025-3857 CVE-2025-54996 GHSA-vf84-mxrq-crqc
- GO-2025-3858 CVE-2025-54997 GHSA-xp75-r577-cvhp
- GO-2025-3859 CVE-2025-55001 GHSA-2q8q-8fgw-9p6p
-
Update to version 0.0.20250807T150727 2025-08-07T15:07:27Z (jsc#PED-11136)
Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2025-3849 CVE-2025-47907
- Record
SUSE-SU-2025:02912-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02913-1 No score
Security update for docker
This update for docker fixes the following issues:
- Update to Docker 28.3.3-ce.
- CVE-2025-54388: Fixed a bug where firewalld when reloaded can make published container ports accessible from remote hosts. (bsc#1247367)
- Record
SUSE-SU-2025:02913-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02914-1 No score
Security update for docker
This update for docker fixes the following issues:
- Update to Docker 28.3.3-ce.
- CVE-2025-54388: Fixed a bug where firewalld when reloaded can make published container ports accessible from remote hosts. (bsc#1247367)
- Record
SUSE-SU-2025:02914-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20565-1 No score
Security update for docker
This update for docker fixes the following issues:
-
Update to Docker 28.3.3-ce:
- CVE-2025-54388: firewalld reload can make published container ports accessible from remote hosts (bsc#1247367)
-
Update to docker-buildx v0.26.1.
- Record
SUSE-SU-2025:20565-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20743-1 No score
Security update for docker
This update for docker fixes the following issues:
Update to docker-buildx v0.28.0.
See upstream changelog: https://github.com/docker/buildx/releases/tag/v0.28.0
Update to Docker 28.4.0-ce.
See upstream changelog: https://docs.docker.com/engine/release-notes/28/#2840
-
Update warnings and errors related to "docker buildx ..." so that they reference our openSUSE docker-buildx packages.
-
Enable building docker-buildx for SLE15 systems with SUSEConnect secret injection enabled.jsc#PED-12534jsc#PED-8905 bsc#1247594
As docker-buildx does not support our SUSEConnect secret injection (and some users depend "docker build" working transparently), patch the docker CLI so that "docker build" will no longer automatically call "docker buildx build", effectively making DOCKER_BUILDKIT=0 the default configuration. Users can manually use "docker buildx ..." commands or set DOCKER_BUILDKIT=1 in order to opt-in to using docker-buildx.
Users can silence the "docker build" warning by setting DOCKER_BUILDKIT=0 explicitly.
In order to inject SCC credentials with docker-buildx, users should use
RUN --mount=type=secret,id=SCCcredentials zypper -n ...
in their Dockerfiles, and
docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
when doing their builds.
Update to Docker 28.3.3-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/28/#2833
Security issue fixed:
- CVE-2025-54388: firewalld reload can make published container ports accessible from remote hosts (bsc#1247367)
Update to docker-buildx v0.26.1. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.26.1
Update to docker-buildx v0.26.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.26.0
- Record
SUSE-SU-2025:20743-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20095-1 No score
Security update for docker
This update for docker fixes the following issues:
Changes in docker:
-
Update to Docker 28.5.1-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/28/#2851
-
Update to Docker 28.5.0-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/28/#2850
-
Update to docker-buildx v0.29.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.29.0
-
Remove git-core recommends on SLE. Most SLE systems have installRecommends=yes by default and thus end up installing git with Docker. bsc#1250508
This feature is mostly intended for developers ("docker build git://") so most users already have the dependency installed, and the error when git is missing is fairly straightforward (so they can easily figure out what they need to install).
-
Update to docker-buildx v0.28.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.28.0
-
Update to Docker 28.4.0-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/28/#2840
- Fixes a nil pointer panic in "docker push". bsc#1248373
-
Update warnings and errors related to "docker buildx ..." so that they reference our openSUSE docker-buildx packages.
-
Enable building docker-buildx for SLE15 systems with SUSEConnect secret injection enabled. PED-12534 PED-8905 bsc#1247594
As docker-buildx does not support our SUSEConnect secret injection (and some users depend "docker build" working transparently), patch the docker CLI so that "docker build" will no longer automatically call "docker buildx build", effectively making DOCKER_BUILDKIT=0 the default configuration. Users can manually use "docker buildx ..." commands or set DOCKER_BUILDKIT=1 in order to opt-in to using docker-buildx.
Users can silence the "docker build" warning by setting DOCKER_BUILDKIT=0 explicitly.
In order to inject SCC credentials with docker-buildx, users should use
RUN --mount=type=secret,id=SCCcredentials zypper -n ...
in their Dockerfiles, and
docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
when doing their builds.
-
Update to Docker 28.3.3-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/28/#2833 CVE-2025-54388 bsc#1247367
-
Update to docker-buildx v0.26.1. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.26.1
-
Update to docker-buildx v0.26.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.26.0
- Record
SUSE-SU-2026:20095-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20112-1 No score
Security update for docker
This update for docker fixes the following issues:
Changes in docker:
-
Update to Docker 28.5.1-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/28/#2851
-
Update to Docker 28.5.0-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/28/#2850
-
Update to docker-buildx v0.29.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.29.0
-
Remove git-core recommends on SLE. Most SLE systems have installRecommends=yes by default and thus end up installing git with Docker. bsc#1250508
This feature is mostly intended for developers ("docker build git://") so most users already have the dependency installed, and the error when git is missing is fairly straightforward (so they can easily figure out what they need to install).
-
Update to docker-buildx v0.28.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.28.0
-
Update to Docker 28.4.0-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/28/#2840
- Fixes a nil pointer panic in "docker push". bsc#1248373
-
Update warnings and errors related to "docker buildx ..." so that they reference our openSUSE docker-buildx packages.
-
Enable building docker-buildx for SLE15 systems with SUSEConnect secret injection enabled. PED-12534 PED-8905 bsc#1247594
As docker-buildx does not support our SUSEConnect secret injection (and some users depend "docker build" working transparently), patch the docker CLI so that "docker build" will no longer automatically call "docker buildx build", effectively making DOCKER_BUILDKIT=0 the default configuration. Users can manually use "docker buildx ..." commands or set DOCKER_BUILDKIT=1 in order to opt-in to using docker-buildx.
Users can silence the "docker build" warning by setting DOCKER_BUILDKIT=0 explicitly.
In order to inject SCC credentials with docker-buildx, users should use
RUN --mount=type=secret,id=SCCcredentials zypper -n ...
in their Dockerfiles, and
docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
when doing their builds.
-
Update to Docker 28.3.3-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/28/#2833 CVE-2025-54388 bsc#1247367
-
Update to docker-buildx v0.26.1. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.26.1
-
Update to docker-buildx v0.26.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.26.0
- Record
SUSE-SU-2026:20112-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/docker/dockerGo |
28.2.0 up to 28.3.3 | 28.3.3 |
dockerAlpine:v3.22 |
before 28.3.3-r0 | 28.3.3-r0 |
dockerAlpine:v3.23 |
before 28.3.3-r0 | 28.3.3-r0 |
dockerAlpine:v3.24 |
before 28.3.3-r0 | 28.3.3-r0 |
dockerAlpaquita:25 |
28.2.1-r0 up to 28.3.3-r0 | 28.3.3-r0 |
dockerAlpaquita:stream |
28.2.1-r0 up to 28.3.3-r0 | 28.3.3-r0 |
github.com/docker/dockerGo |
28.2.0+incompatible up to 28.3.3+incompatible | 28.3.3+incompatible |
govulncheck-vulndbSUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 31 CVEs |
before 0.0.20250814T182633-150000.1.98.1 | 0.0.20250814T182633-150000.1.98.1 |
govulncheck-vulndbopenSUSE:Leap 15.6 From an advisory covering 31 CVEs |
before 0.0.20250814T182633-150000.1.98.1 | 0.0.20250814T182633-150000.1.98.1 |
dockerSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 28.3.3_ce-98.137.1 | 28.3.3_ce-98.137.1 |
Show 42 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dockerSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 28.3.3_ce-98.137.1 | 28.3.3_ce-98.137.1 |
dockerSUSE:Linux Enterprise Micro 5.3 |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise Micro 5.4 |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise Micro 5.5 |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise Module for Containers 15 SP6 |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise Module for Containers 15 SP7 |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise Micro 5.1 |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Enterprise Micro 5.2 |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Enterprise Storage 7.1 |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockeropenSUSE:Leap 15.6 |
before 28.3.3_ce-150000.230.1 | 28.3.3_ce-150000.230.1 |
dockerSUSE:Linux Micro 6.0 |
before 28.3.3_ce-6.1 | 28.3.3_ce-6.1 |
dockerSUSE:Linux Micro 6.1 |
before 28.4.0_ce-slfo.1.1_6.1 | 28.4.0_ce-slfo.1.1_6.1 |
dockerSUSE:Linux Enterprise Server 16.0 |
before 28.5.1_ce-160000.4.1 | 28.5.1_ce-160000.4.1 |
dockerSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 28.5.1_ce-160000.4.1 | 28.5.1_ce-160000.4.1 |
dockerSUSE:Linux Micro 6.2 |
before 28.5.1_ce-160000.4.1 | 28.5.1_ce-160000.4.1 |
docker.ioUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.6.2~dfsg1-1ubuntu41.10.2-0ubuntu31.10.2-0ubuntu41.10.3-0ubuntu11.10.3-0ubuntu4 Show 19 moreShow less1.10.3-0ubuntu51.10.3-0ubuntu61.11.2-0ubuntu5~16.041.12.1-0ubuntu13~16.04.11.12.3-0ubuntu4~16.04.21.12.6-0ubuntu1~16.04.11.13.1-0ubuntu1~16.04.217.03.2-0ubuntu2~16.04.118.06.1-0ubuntu1~16.04.218.06.1-0ubuntu1.2~16.04.118.09.2-0ubuntu1~16.04.118.09.5-0ubuntu1~16.04.218.09.7-0ubuntu1~16.04.118.09.7-0ubuntu1~16.04.418.09.7-0ubuntu1~16.04.518.09.7-0ubuntu1~16.04.618.09.7-0ubuntu1~16.04.718.09.7-0ubuntu1~16.04.9+esm118.09.7-0ubuntu1~16.04.9+esm2 |
None known |
docker.ioUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.13.1-0ubuntu617.03.2-0ubuntu117.03.2-0ubuntu317.03.2-0ubuntu517.12.1-0ubuntu1 Show 22 moreShow less18.06.1-0ubuntu1~18.04.118.06.1-0ubuntu1.2~18.04.118.09.2-0ubuntu1~18.04.118.09.5-0ubuntu1~18.04.218.09.7-0ubuntu1~18.04.118.09.7-0ubuntu1~18.04.318.09.7-0ubuntu1~18.04.419.03.6-0ubuntu1~18.04.119.03.6-0ubuntu1~18.04.219.03.6-0ubuntu1~18.04.320.10.2-0ubuntu1~18.04.220.10.2-0ubuntu1~18.04.320.10.7-0ubuntu1~18.04.120.10.7-0ubuntu1~18.04.220.10.7-0ubuntu5~18.04.220.10.7-0ubuntu5~18.04.320.10.12-0ubuntu2~18.04.120.10.21-0ubuntu1~18.04.220.10.21-0ubuntu1~18.04.320.10.21-0ubuntu1~18.04.3+esm120.10.21-0ubuntu1~18.04.3+esm220.10.21-0ubuntu1~18.04.3+esm3 |
None known |
docker.ioUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 19.03.2-0ubuntu119.03.6-0ubuntu119.03.8-0ubuntu119.03.8-0ubuntu1.20.0419.03.8-0ubuntu1.20.04.1 Show 15 moreShow less19.03.8-0ubuntu1.20.04.220.10.2-0ubuntu1~20.04.220.10.2-0ubuntu1~20.04.320.10.7-0ubuntu1~20.04.120.10.7-0ubuntu1~20.04.220.10.7-0ubuntu5~20.04.120.10.7-0ubuntu5~20.04.220.10.12-0ubuntu2~20.04.120.10.21-0ubuntu1~20.04.120.10.21-0ubuntu1~20.04.220.10.21-0ubuntu1~20.04.420.10.21-0ubuntu1~20.04.520.10.21-0ubuntu1~20.04.620.10.21-0ubuntu1~20.04.6+esm120.10.21-0ubuntu1~20.04.6+esm2 |
None known |
docker.ioUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 20.10.7-0ubuntu520.10.7-0ubuntu720.10.12-0ubuntu120.10.12-0ubuntu220.10.12-0ubuntu3 Show 11 moreShow less20.10.12-0ubuntu3+gke1.24.120.10.12-0ubuntu420.10.21-0ubuntu1~22.04.220.10.21-0ubuntu1~22.04.320.10.21-0ubuntu1~22.04.520.10.21-0ubuntu1~22.04.620.10.21-0ubuntu1~22.04.720.10.21-0ubuntu1~22.04.7+esm120.10.21-0ubuntu1~22.04.7+esm220.10.21-0ubuntu1~22.04.820.10.21-0ubuntu1~22.04.8+esm1 |
None known |
docker.io-appUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 20.10.25-0ubuntu1~22.04.120.10.25-0ubuntu1~22.04.224.0.5-0ubuntu1~22.04.124.0.7-0ubuntu2~22.04.126.1.3-0ubuntu1~22.04.1 Show 6 moreShow less26.1.3-0ubuntu1~22.04.1+esm127.5.1-0ubuntu3~22.04.127.5.1-0ubuntu3~22.04.228.2.2-0ubuntu1~22.04.129.1.3-0ubuntu3~22.04.129.1.3-0ubuntu3~22.04.2 |
None known |
docker.ioUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 20.10.24+dfsg1-1ubuntu220.10.25+dfsg1-2ubuntu120.10.25+dfsg1-2ubuntu1+esm120.10.25+dfsg1-2ubuntu1+esm220.10.25+dfsg1-2ubuntu1.24.04.120.10.25+dfsg1-2ubuntu1.24.04.1+esm1 |
None known |
docker.io-appUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 24.0.5-0ubuntu124.0.7-0ubuntu124.0.7-0ubuntu224.0.7-0ubuntu324.0.7-0ubuntu4 Show 8 moreShow less24.0.7-0ubuntu4.126.1.3-0ubuntu1~24.04.126.1.3-0ubuntu1~24.04.1+esm127.5.1-0ubuntu3~24.04.127.5.1-0ubuntu3~24.04.228.2.2-0ubuntu1~24.04.129.1.3-0ubuntu3~24.04.129.1.3-0ubuntu3~24.04.2 |
None known |
docker.ioUbuntu:25.10 |
All versions, plus listed versions 26.1.5+dfsg1-9ubuntu1 |
None known |
docker.io-appUbuntu:25.10 |
All versions, plus listed versions 27.5.1-0ubuntu327.5.1-0ubuntu428.2.2-0ubuntu129.1.3-0ubuntu3~25.10.1 |
None known |
docker.ioUbuntu:26.10 |
All versions, plus listed versions 27.5.1+dfsg4-2ubuntu128.5.2+dfsg4-5ubuntu1 |
None known |
docker.ioUbuntu:26.04:LTS |
All versions, plus listed versions 26.1.5+dfsg1-9ubuntu127.5.1+dfsg4-1ubuntu127.5.1+dfsg4-2ubuntu1 |
None known |
docker.io-appUbuntu:26.04:LTS |
All versions, plus listed versions 28.2.2-0ubuntu129.1.2-0ubuntu129.1.3-0ubuntu129.1.3-0ubuntu229.1.3-0ubuntu329.1.3-0ubuntu429.1.3-0ubuntu4.1 |
None known |
dockeropenSUSE:Tumbleweed |
before 28.3.3_ce-26.1 | 28.3.3_ce-26.1 |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 29 CVEs |
before 0.0.20250811T192933-1.1 | 0.0.20250811T192933-1.1 |
dockeropenSUSE:Leap 16.0 |
before 28.5.1_ce-160000.4.1 | 28.5.1_ce-160000.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-54388 is a medium vulnerability (CVSS 5.1) in Moby, published July 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in github.com/docker/docker 28.3.3.
References
github.com/moby/moby/security/advisories/GHSA-x4rx-4gw3-53p4
nvd.nist.gov/vuln/detail/CVE-2025-54388
security.alpinelinux.org/vuln/CVE-2025-54388
Show 48 moreShow less
docs.bell-sw.com/security/cves/CVE-2025-54388
suse.com/support/update/announcement/2025/suse-su-202502912-1
bugzilla.suse.com/1246556
ubuntu.com/security/CVE-2025-54388
cve.org/CVERecord?id=CVE-2025-54388