{"id":"CVE-2022-36109","aliases":["ALPINE-CVE-2022-36109","BELL-CVE-2022-36109","DEBIAN-CVE-2022-36109","EUVD-2022-6933","GHSA-rc4r-wh2q-q6c4","GO-2022-0985","MGASA-2023-0009","OESA-2022-1936","SUSE-SU-2023:0795-1","SUSE-SU-2023:0795-2","SUSE-SU-2023:1625-1","SUSE-SU-2025:03540-1","SUSE-SU-2025:03545-1","UBUNTU-CVE-2022-36109","openSUSE-SU-2024:12790-1","openSUSE-SU-2025:15589-1"],"status":"published","title":"Moby vulnerability relating to supplementary group permissions","description":"Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.  This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `\"USER $USERNAME\"` Dockerfile instruction. Instead by calling `ENTRYPOINT [\"su\", \"-\", \"user\"]` the supplementary groups will be set up properly.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01054,"percentile":0.64669,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2022-09-09T17:20:11Z","modified":"2026-11-03T07:30:39Z","fixes":[{"ecosystem":"Go","package":"github.com/docker/docker","fixed_in":["20.10.18","20.10.18+incompatible"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"docker","fixed_in":["20.10.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"docker","fixed_in":["20.10.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"docker","fixed_in":["20.10.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"docker","fixed_in":["20.10.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"docker","fixed_in":["20.10.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"docker","fixed_in":["20.10.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"docker","fixed_in":["20.10.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"docker","fixed_in":["20.10.18-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"docker","fixed_in":["20.10.18-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"docker.io","fixed_in":["20.10.19+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"docker.io","fixed_in":["20.10.19+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"docker.io","fixed_in":["20.10.19+dfsg1-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"docker","fixed_in":["engine-18.09.0-243.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"docker","fixed_in":["engine-18.09.0-243.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"docker","fixed_in":["engine-18.09.0-310.oe2203"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"docker","fixed_in":["20.10.23_ce-150000.175.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker","fixed_in":["20.10.23_ce-98.89.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"docker.io","fixed_in":["20.10.21-0ubuntu1~18.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"docker.io","fixed_in":["20.10.21-0ubuntu1~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"docker.io","fixed_in":["20.10.21-0ubuntu1~22.04.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"docker","fixed_in":["20.10.23_ce-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/docker/docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.18"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.18-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.18-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.19+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.19+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.19+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/docker/docker","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.10.18"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/docker/docker","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.10.18+incompatible"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.22-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"engine-18.09.0-243.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"engine-18.09.0-243.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"engine-18.09.0-310.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-150000.175.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-98.89.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-1.20.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-1.20.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.2~dfsg1-1ubuntu4","1.10.2-0ubuntu3","1.10.2-0ubuntu4","1.10.3-0ubuntu1","1.10.3-0ubuntu4","1.10.3-0ubuntu5","1.10.3-0ubuntu6","1.11.2-0ubuntu5~16.04","1.12.1-0ubuntu13~16.04.1","1.12.3-0ubuntu4~16.04.2","1.12.6-0ubuntu1~16.04.1","1.13.1-0ubuntu1~16.04.2","17.03.2-0ubuntu2~16.04.1","18.06.1-0ubuntu1~16.04.2","18.06.1-0ubuntu1.2~16.04.1","18.09.2-0ubuntu1~16.04.1","18.09.5-0ubuntu1~16.04.2","18.09.7-0ubuntu1~16.04.1","18.09.7-0ubuntu1~16.04.4","18.09.7-0ubuntu1~16.04.5","18.09.7-0ubuntu1~16.04.6","18.09.7-0ubuntu1~16.04.7","18.09.7-0ubuntu1~16.04.9+esm1","18.09.7-0ubuntu1~16.04.9+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.21-0ubuntu1~18.04.2"}]}],"versions":["1.13.1-0ubuntu6","17.03.2-0ubuntu1","17.03.2-0ubuntu3","17.03.2-0ubuntu5","17.12.1-0ubuntu1","18.06.1-0ubuntu1~18.04.1","18.06.1-0ubuntu1.2~18.04.1","18.09.2-0ubuntu1~18.04.1","18.09.5-0ubuntu1~18.04.2","18.09.7-0ubuntu1~18.04.1","18.09.7-0ubuntu1~18.04.3","18.09.7-0ubuntu1~18.04.4","19.03.6-0ubuntu1~18.04.1","19.03.6-0ubuntu1~18.04.2","19.03.6-0ubuntu1~18.04.3","20.10.2-0ubuntu1~18.04.2","20.10.2-0ubuntu1~18.04.3","20.10.7-0ubuntu1~18.04.1","20.10.7-0ubuntu1~18.04.2","20.10.7-0ubuntu5~18.04.2","20.10.7-0ubuntu5~18.04.3","20.10.12-0ubuntu2~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.21-0ubuntu1~20.04.1"}]}],"versions":["19.03.2-0ubuntu1","19.03.6-0ubuntu1","19.03.8-0ubuntu1","19.03.8-0ubuntu1.20.04","19.03.8-0ubuntu1.20.04.1","19.03.8-0ubuntu1.20.04.2","20.10.2-0ubuntu1~20.04.2","20.10.2-0ubuntu1~20.04.3","20.10.7-0ubuntu1~20.04.1","20.10.7-0ubuntu1~20.04.2","20.10.7-0ubuntu5~20.04.1","20.10.7-0ubuntu5~20.04.2","20.10.12-0ubuntu2~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.21-0ubuntu1~22.04.2"}]}],"versions":["20.10.7-0ubuntu5","20.10.7-0ubuntu7","20.10.12-0ubuntu1","20.10.12-0ubuntu2","20.10.12-0ubuntu3","20.10.12-0ubuntu3+gke1.24.1","20.10.12-0ubuntu4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.23_ce-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-15.1"}]}],"bundled":43}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"moby","product":"moby"},{"vendor":"mobyproject","product":"moby"}],"references":[{"url":"https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/moby/moby/commit/de7af816e76a7fd3fbf06bffa6832959289fba32","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/moby/moby/releases/tag/v20.10.18","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7JL2QA3RB732MLJ3RMUXB3IB7AA22YU","tags":["x_refsource_MISC","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQQ4E3JBXVR3VK5FIZVJ3QS2TAOOXXTQ","tags":["x_refsource_MISC","web"]},{"url":"https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation","tags":["x_refsource_MISC","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQQ4E3JBXVR3VK5FIZVJ3QS2TAOOXXTQ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7JL2QA3RB732MLJ3RMUXB3IB7AA22YU/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36109","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7JL2QA3RB732MLJ3RMUXB3IB7AA22YU","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQQ4E3JBXVR3VK5FIZVJ3QS2TAOOXXTQ","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rc4r-wh2q-q6c4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-36109","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-36109","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36109.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-36109","tags":["advisory"]},{"url":"https://github.com/moby/moby","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0009.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30834","tags":["report"]},{"url":"https://docs.docker.com/engine/release-notes/#201018","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RQQ4E3JBXVR3VK5FIZVJ3QS2TAOOXXTQ/","tags":["web"]},{"url":"https://docs.docker.com/engine/release-notes/#201020","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/VFYXCTLOSESYIP72BUYD6ECDIMUM4WMB/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RBODKZL7HQE5XXS3SA2VIDVL4LAA5RWH/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1936","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230795-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205375","tags":["report"]},{"url":"https://bugzilla.suse.com/1206065","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36109","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230795-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231625-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188447","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503540-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1001161","tags":["report"]},{"url":"https://bugzilla.suse.com/1004490","tags":["report"]},{"url":"https://bugzilla.suse.com/1007249","tags":["report"]},{"url":"https://bugzilla.suse.com/1009961","tags":["report"]},{"url":"https://bugzilla.suse.com/1012568","tags":["report"]},{"url":"https://bugzilla.suse.com/1015661","tags":["report"]},{"url":"https://bugzilla.suse.com/1016307","tags":["report"]},{"url":"https://bugzilla.suse.com/1016992","tags":["report"]},{"url":"https://bugzilla.suse.com/1019251","tags":["report"]},{"url":"https://bugzilla.suse.com/1020806","tags":["report"]},{"url":"https://bugzilla.suse.com/1021227","tags":["report"]},{"url":"https://bugzilla.suse.com/1026827","tags":["report"]},{"url":"https://bugzilla.suse.com/1028638","tags":["report"]},{"url":"https://bugzilla.suse.com/1028639","tags":["report"]},{"url":"https://bugzilla.suse.com/1029320","tags":["report"]},{"url":"https://bugzilla.suse.com/1029630","tags":["report"]},{"url":"https://bugzilla.suse.com/1030702","tags":["report"]},{"url":"https://bugzilla.suse.com/1032287","tags":["report"]},{"url":"https://bugzilla.suse.com/1032644","tags":["report"]},{"url":"https://bugzilla.suse.com/1034053","tags":["report"]},{"url":"https://bugzilla.suse.com/1034063","tags":["report"]},{"url":"https://bugzilla.suse.com/1037436","tags":["report"]},{"url":"https://bugzilla.suse.com/1037607","tags":["report"]},{"url":"https://bugzilla.suse.com/1038476","tags":["report"]},{"url":"https://bugzilla.suse.com/1038493","tags":["report"]},{"url":"https://bugzilla.suse.com/1045628","tags":["report"]},{"url":"https://bugzilla.suse.com/1046024","tags":["report"]},{"url":"https://bugzilla.suse.com/1047218","tags":["report"]},{"url":"https://bugzilla.suse.com/1048046","tags":["report"]},{"url":"https://bugzilla.suse.com/1051429","tags":["report"]},{"url":"https://bugzilla.suse.com/1055676","tags":["report"]},{"url":"https://bugzilla.suse.com/1057743","tags":["report"]},{"url":"https://bugzilla.suse.com/1058173","tags":["report"]},{"url":"https://bugzilla.suse.com/1059011","tags":["report"]},{"url":"https://bugzilla.suse.com/1064781","tags":["report"]},{"url":"https://bugzilla.suse.com/1065609","tags":["report"]},{"url":"https://bugzilla.suse.com/1066210","tags":["report"]},{"url":"https://bugzilla.suse.com/1066801","tags":["report"]},{"url":"https://bugzilla.suse.com/1069468","tags":["report"]},{"url":"https://bugzilla.suse.com/1069758","tags":["report"]},{"url":"https://bugzilla.suse.com/1072798","tags":["report"]},{"url":"https://bugzilla.suse.com/1073877","tags":["report"]},{"url":"https://bugzilla.suse.com/1074971","tags":["report"]},{"url":"https://bugzilla.suse.com/1080978","tags":["report"]},{"url":"https://bugzilla.suse.com/1084533","tags":["report"]},{"url":"https://bugzilla.suse.com/1085117","tags":["report"]},{"url":"https://bugzilla.suse.com/1085380","tags":["report"]},{"url":"https://bugzilla.suse.com/1086185","tags":["report"]},{"url":"https://bugzilla.suse.com/1089732","tags":["report"]},{"url":"https://bugzilla.suse.com/1095817","tags":["report"]},{"url":"https://bugzilla.suse.com/1096726","tags":["report"]},{"url":"https://bugzilla.suse.com/1099277","tags":["report"]},{"url":"https://bugzilla.suse.com/1100331","tags":["report"]},{"url":"https://bugzilla.suse.com/1100727","tags":["report"]},{"url":"https://bugzilla.suse.com/1102522","tags":["report"]},{"url":"https://bugzilla.suse.com/1104821","tags":["report"]},{"url":"https://bugzilla.suse.com/1105000","tags":["report"]},{"url":"https://bugzilla.suse.com/1108038","tags":["report"]},{"url":"https://bugzilla.suse.com/1112980","tags":["report"]},{"url":"https://bugzilla.suse.com/1113313","tags":["report"]},{"url":"https://bugzilla.suse.com/1114832","tags":["report"]},{"url":"https://bugzilla.suse.com/1115464","tags":["report"]},{"url":"https://bugzilla.suse.com/1118897","tags":["report"]},{"url":"https://bugzilla.suse.com/1118898","tags":["report"]},{"url":"https://bugzilla.suse.com/1118899","tags":["report"]},{"url":"https://bugzilla.suse.com/1118990","tags":["report"]},{"url":"https://bugzilla.suse.com/1119634","tags":["report"]},{"url":"https://bugzilla.suse.com/1121412","tags":["report"]},{"url":"https://bugzilla.suse.com/1121768","tags":["report"]},{"url":"https://bugzilla.suse.com/1122469","tags":["report"]},{"url":"https://bugzilla.suse.com/1124308","tags":["report"]},{"url":"https://bugzilla.suse.com/1128376","tags":["report"]},{"url":"https://bugzilla.suse.com/1128746","tags":["report"]},{"url":"https://bugzilla.suse.com/1134068","tags":["report"]},{"url":"https://bugzilla.suse.com/1138920","tags":["report"]},{"url":"https://bugzilla.suse.com/1139649","tags":["report"]},{"url":"https://bugzilla.suse.com/1142160","tags":["report"]},{"url":"https://bugzilla.suse.com/1142413","tags":["report"]},{"url":"https://bugzilla.suse.com/1143349","tags":["report"]},{"url":"https://bugzilla.suse.com/1150397","tags":["report"]},{"url":"https://bugzilla.suse.com/1153367","tags":["report"]},{"url":"https://bugzilla.suse.com/1157330","tags":["report"]},{"url":"https://bugzilla.suse.com/1158590","tags":["report"]},{"url":"https://bugzilla.suse.com/1170415","tags":["report"]},{"url":"https://bugzilla.suse.com/1170446","tags":["report"]},{"url":"https://bugzilla.suse.com/1172377","tags":["report"]},{"url":"https://bugzilla.suse.com/1174075","tags":["report"]},{"url":"https://bugzilla.suse.com/1175081","tags":["report"]},{"url":"https://bugzilla.suse.com/1176708","tags":["report"]},{"url":"https://bugzilla.suse.com/1178760","tags":["report"]},{"url":"https://bugzilla.suse.com/1178801","tags":["report"]},{"url":"https://bugzilla.suse.com/1180243","tags":["report"]},{"url":"https://bugzilla.suse.com/1180401","tags":["report"]},{"url":"https://bugzilla.suse.com/1181594","tags":["report"]},{"url":"https://bugzilla.suse.com/1181641","tags":["report"]},{"url":"https://bugzilla.suse.com/1181677","tags":["report"]},{"url":"https://bugzilla.suse.com/1181730","tags":["report"]},{"url":"https://bugzilla.suse.com/1181732","tags":["report"]},{"url":"https://bugzilla.suse.com/1182168","tags":["report"]},{"url":"https://bugzilla.suse.com/1182476","tags":["report"]},{"url":"https://bugzilla.suse.com/1182947","tags":["report"]},{"url":"https://bugzilla.suse.com/1183855","tags":["report"]},{"url":"https://bugzilla.suse.com/1184768","tags":["report"]},{"url":"https://bugzilla.suse.com/1190670","tags":["report"]},{"url":"https://bugzilla.suse.com/1191015","tags":["report"]},{"url":"https://bugzilla.suse.com/1191121","tags":["report"]},{"url":"https://bugzilla.suse.com/1191334","tags":["report"]},{"url":"https://bugzilla.suse.com/1191355","tags":["report"]},{"url":"https://bugzilla.suse.com/1191434","tags":["report"]},{"url":"https://bugzilla.suse.com/1192814","tags":["report"]},{"url":"https://bugzilla.suse.com/1193273","tags":["report"]},{"url":"https://bugzilla.suse.com/1193930","tags":["report"]},{"url":"https://bugzilla.suse.com/1197284","tags":["report"]},{"url":"https://bugzilla.suse.com/1197517","tags":["report"]},{"url":"https://bugzilla.suse.com/1200022","tags":["report"]},{"url":"https://bugzilla.suse.com/1200145","tags":["report"]},{"url":"https://bugzilla.suse.com/1208074","tags":["report"]},{"url":"https://bugzilla.suse.com/1210141","tags":["report"]},{"url":"https://bugzilla.suse.com/1210797","tags":["report"]},{"url":"https://bugzilla.suse.com/1211578","tags":["report"]},{"url":"https://bugzilla.suse.com/1212368","tags":["report"]},{"url":"https://bugzilla.suse.com/1213120","tags":["report"]},{"url":"https://bugzilla.suse.com/1213229","tags":["report"]},{"url":"https://bugzilla.suse.com/1213500","tags":["report"]},{"url":"https://bugzilla.suse.com/1214107","tags":["report"]},{"url":"https://bugzilla.suse.com/1214108","tags":["report"]},{"url":"https://bugzilla.suse.com/1214109","tags":["report"]},{"url":"https://bugzilla.suse.com/1215323","tags":["report"]},{"url":"https://bugzilla.suse.com/1217513","tags":["report"]},{"url":"https://bugzilla.suse.com/1219267","tags":["report"]},{"url":"https://bugzilla.suse.com/1219268","tags":["report"]},{"url":"https://bugzilla.suse.com/1219438","tags":["report"]},{"url":"https://bugzilla.suse.com/1240150","tags":["report"]},{"url":"https://bugzilla.suse.com/1247362","tags":["report"]},{"url":"https://bugzilla.suse.com/1250508","tags":["report"]},{"url":"https://bugzilla.suse.com/1250596","tags":["report"]},{"url":"https://bugzilla.suse.com/885209","tags":["report"]},{"url":"https://bugzilla.suse.com/907012","tags":["report"]},{"url":"https://bugzilla.suse.com/907014","tags":["report"]},{"url":"https://bugzilla.suse.com/908033","tags":["report"]},{"url":"https://bugzilla.suse.com/909709","tags":["report"]},{"url":"https://bugzilla.suse.com/909710","tags":["report"]},{"url":"https://bugzilla.suse.com/909712","tags":["report"]},{"url":"https://bugzilla.suse.com/913211","tags":["report"]},{"url":"https://bugzilla.suse.com/913213","tags":["report"]},{"url":"https://bugzilla.suse.com/920645","tags":["report"]},{"url":"https://bugzilla.suse.com/930235","tags":["report"]},{"url":"https://bugzilla.suse.com/931301","tags":["report"]},{"url":"https://bugzilla.suse.com/935570","tags":["report"]},{"url":"https://bugzilla.suse.com/938156","tags":["report"]},{"url":"https://bugzilla.suse.com/942369","tags":["report"]},{"url":"https://bugzilla.suse.com/942370","tags":["report"]},{"url":"https://bugzilla.suse.com/946653","tags":["report"]},{"url":"https://bugzilla.suse.com/949660","tags":["report"]},{"url":"https://bugzilla.suse.com/950931","tags":["report"]},{"url":"https://bugzilla.suse.com/953182","tags":["report"]},{"url":"https://bugzilla.suse.com/954737","tags":["report"]},{"url":"https://bugzilla.suse.com/954797","tags":["report"]},{"url":"https://bugzilla.suse.com/954812","tags":["report"]},{"url":"https://bugzilla.suse.com/956434","tags":["report"]},{"url":"https://bugzilla.suse.com/958255","tags":["report"]},{"url":"https://bugzilla.suse.com/959405","tags":["report"]},{"url":"https://bugzilla.suse.com/963142","tags":["report"]},{"url":"https://bugzilla.suse.com/964468","tags":["report"]},{"url":"https://bugzilla.suse.com/964673","tags":["report"]},{"url":"https://bugzilla.suse.com/965600","tags":["report"]},{"url":"https://bugzilla.suse.com/965918","tags":["report"]},{"url":"https://bugzilla.suse.com/968933","tags":["report"]},{"url":"https://bugzilla.suse.com/968972","tags":["report"]},{"url":"https://bugzilla.suse.com/970637","tags":["report"]},{"url":"https://bugzilla.suse.com/974208","tags":["report"]},{"url":"https://bugzilla.suse.com/976777","tags":["report"]},{"url":"https://bugzilla.suse.com/977394","tags":["report"]},{"url":"https://bugzilla.suse.com/978260","tags":["report"]},{"url":"https://bugzilla.suse.com/980555","tags":["report"]},{"url":"https://bugzilla.suse.com/983015","tags":["report"]},{"url":"https://bugzilla.suse.com/984942","tags":["report"]},{"url":"https://bugzilla.suse.com/987198","tags":["report"]},{"url":"https://bugzilla.suse.com/988408","tags":["report"]},{"url":"https://bugzilla.suse.com/988707","tags":["report"]},{"url":"https://bugzilla.suse.com/989566","tags":["report"]},{"url":"https://bugzilla.suse.com/993847","tags":["report"]},{"url":"https://bugzilla.suse.com/995058","tags":["report"]},{"url":"https://bugzilla.suse.com/995102","tags":["report"]},{"url":"https://bugzilla.suse.com/995620","tags":["report"]},{"url":"https://bugzilla.suse.com/996015","tags":["report"]},{"url":"https://bugzilla.suse.com/999582","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503545-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-36109","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-36109","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-36109","title":"Moby vulnerability relating to supplementary group permissions","description":"Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.  This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `\"USER $USERNAME\"` Dockerfile instruction. Instead by calling `ENTRYPOINT [\"su\", \"-\", \"user\"]` the supplementary groups will be set up properly.","status":"published","published":"2022-09-09T17:20:11Z","modified":"2025-04-23T17:12:31.122Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:35.945659Z"}],"euvd":[{"id":"EUVD-2022-6933","description":"Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.  This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `\"USER $USERNAME\"` Dockerfile instruction. Instead by calling `ENTRYPOINT [\"su\", \"-\", \"user\"]` the supplementary groups will be set up properly.","status":"published","published":"2022-09-09T17:20:11Z","modified":"2025-04-23T17:12:31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:10.906327Z"}],"ghsa":[{"id":"GHSA-rc4r-wh2q-q6c4","title":"Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions","description":"Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.  This bug is fixed in Moby (Docker Engine) 20.10.18. Users should update to this version when it is available. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `\"USER $USERNAME\"` Dockerfile instruction. Instead by calling `ENTRYPOINT [\"su\", \"-\", \"user\"]` the supplementary groups will be set up properly.\n\nThanks to Steven Murdoch for reporting this issue.\n\n----\n\n### Impact\n\nIf an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. \n\n### Patches\n\n This bug is fixed in Moby (Docker Engine) 20.10.18. Users should update to this version when it is available.\n\n### Workarounds\n\nThis problem can be worked around by not using the `\"USER $USERNAME\"` Dockerfile instruction. Instead by calling `ENTRYPOINT [\"su\", \"-\", \"user\"]` the supplementary groups will be set up properly.\n\n### References\n\nhttps://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Open an issue](https://github.com/moby/moby/issues/new)\n* Email us at [security@docker.com](mailto:security@docker.com)\n","status":"published","published":"2022-09-16T21:00:46Z","modified":"2025-01-17T15:55:21Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:38:27.067633Z"}],"nvd":[{"id":"CVE-2022-36109","description":"Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.  This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `\"USER $USERNAME\"` Dockerfile instruction. Instead by calling `ENTRYPOINT [\"su\", \"-\", \"user\"]` the supplementary groups will be set up properly.","status":"published","published":"2022-09-09T18:15:10.54Z","modified":"2026-06-17T04:52:56.423Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:07:27.631109Z"}],"osv":[{"id":"ALPINE-CVE-2022-36109","description":"Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.  This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `\"USER $USERNAME\"` Dockerfile instruction. Instead by calling `ENTRYPOINT [\"su\", \"-\", \"user\"]` the supplementary groups will be set up properly.","status":"published","published":"2022-09-09T18:15:10.54Z","modified":"2026-11-03T07:30:39.807479606Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"BELL-CVE-2022-36109","title":"CVE-2022-36109 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:22.685959Z","modified":"2026-01-26T09:50:07.328683Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-36109","title":"Moby vulnerability relating to supplementary group permissions","description":"Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.  This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `\"USER $USERNAME\"` Dockerfile instruction. Instead by calling `ENTRYPOINT [\"su\", \"-\", \"user\"]` the supplementary groups will be set up properly.","status":"published","published":"2022-09-09T17:20:11Z","modified":"2026-10-28T02:30:41.076697294Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"GHSA-rc4r-wh2q-q6c4","title":"Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions","description":"Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.  This bug is fixed in Moby (Docker Engine) 20.10.18. Users should update to this version when it is available. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `\"USER $USERNAME\"` Dockerfile instruction. Instead by calling `ENTRYPOINT [\"su\", \"-\", \"user\"]` the supplementary groups will be set up properly.\n\nThanks to Steven Murdoch for reporting this issue.\n\n----\n\n### Impact\n\nIf an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. \n\n### Patches\n\n This bug is fixed in Moby (Docker Engine) 20.10.18. Users should update to this version when it is available.\n\n### Workarounds\n\nThis problem can be worked around by not using the `\"USER $USERNAME\"` Dockerfile instruction. Instead by calling `ENTRYPOINT [\"su\", \"-\", \"user\"]` the supplementary groups will be set up properly.\n\n### References\n\nhttps://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Open an issue](https://github.com/moby/moby/issues/new)\n* Email us at [security@docker.com](mailto:security@docker.com)\n","status":"published","published":"2022-09-16T21:00:46Z","modified":"2026-02-04T03:19:55.300995Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"OESA-2022-1936","title":"docker security update","description":"Docker is an open source project to build, ship and run any application as a lightweight container.\r\n\r\nSecurity Fix(es):\r\n\r\nMoby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `\u0026quot;USER $USERNAME\u0026quot;` Dockerfile instruction. Instead by calling `ENTRYPOINT [\u0026quot;su\u0026quot;, \u0026quot;-\u0026quot;, \u0026quot;user\u0026quot;]` the supplementary groups will be set up properly.(CVE-2022-36109)","status":"published","published":"2022-09-23T11:05:14Z","modified":"2026-08-18T01:17:17.133803065Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-36109","description":"Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.  This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `\"USER $USERNAME\"` Dockerfile instruction. Instead by calling `ENTRYPOINT [\"su\", \"-\", \"user\"]` the supplementary groups will be set up properly.","status":"published","published":"2022-09-09T18:15:00Z","modified":"2026-03-24T10:59:15.689253Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"DEBIAN-CVE-2022-36109","description":"Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.  This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `\"USER $USERNAME\"` Dockerfile instruction. Instead by calling `ENTRYPOINT [\"su\", \"-\", \"user\"]` the supplementary groups will be set up properly.","status":"published","published":"2022-09-09T18:15:10.54Z","modified":"2026-11-03T06:02:42.836176678Z","updated_at":"2026-11-03T06:43:43.638289Z"},{"id":"GO-2022-0985","title":"Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions in github.com/docker/docker","description":"Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions in github.com/docker/docker","status":"published","published":"2024-08-21T16:03:24Z","modified":"2026-03-03T04:52:33.87822Z","updated_at":"2026-11-02T15:47:00.918515Z"},{"id":"MGASA-2023-0009","title":"Updated docker packages fix security vulnerability","description":"Server side request forgery (CVE-2022-29153)\n\nBypass primary group restrictions due to a flaw in the supplementary group\naccess setup (CVE-2022-36109)\n\nImported Nodes/Services Information leak in moby-engine. (CVE-2022-3920)\n","status":"published","published":"2023-01-24T07:58:24Z","modified":"2026-04-16T04:40:41.815741113Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12790-1","title":"docker-20.10.23_ce-2.1 on GA media","description":"These are all security issues fixed in the docker-20.10.23_ce-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:33:11.665553Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2025:15589-1","title":"docker-stable-24.0.9_ce-15.1 on GA media","description":"These are all security issues fixed in the docker-stable-24.0.9_ce-15.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-30T00:00:00Z","modified":"2026-03-23T04:53:58.562077Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2023:0795-1","title":"Security update for docker","description":"\nThis update for docker fixes the following issues:\n\nDocker was updated to 20.10.23-ce.\n\nSee upstream changelog at https://docs.docker.com/engine/release-notes/#201023\n\nDocker was updated to 20.10.21-ce (bsc#1206065)\n\nSee upstream changelog at https://docs.docker.com/engine/release-notes/#201021 \n\nSecurity issues fixed:\n\n- CVE-2022-36109: Fixed supplementary group permissions bypass (bsc#1205375)\n\n- Fix wrong After: in docker.service, fixes bsc#1188447\n- Add apparmor-parser as a Recommends to make sure that most users will end up\n  with it installed even if they are primarily running SELinux.\n- Allow to install container-selinux instead of apparmor-parser.\n- Change to using systemd-sysusers\n","status":"published","published":"2023-03-17T08:13:30Z","modified":"2026-02-04T03:16:17.237417Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:0795-2","title":"Security update for docker","description":"\nThis update for docker fixes the following issues:\n\nDocker was updated to 20.10.23-ce.\n\nSee upstream changelog at https://docs.docker.com/engine/release-notes/#201023\n\nDocker was updated to 20.10.21-ce (bsc#1206065)\n\nSee upstream changelog at https://docs.docker.com/engine/release-notes/#201021 \n\nSecurity issues fixed:\n\n- CVE-2022-36109: Fixed supplementary group permissions bypass (bsc#1205375)\n\n- Fix wrong After: in docker.service, fixes bsc#1188447\n- Add apparmor-parser as a Recommends to make sure that most users will end up\n  with it installed even if they are primarily running SELinux.\n- Allow to install container-selinux instead of apparmor-parser.\n- Change to using systemd-sysusers\n","status":"published","published":"2023-04-27T14:06:40Z","modified":"2026-02-04T02:57:12.479201Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1625-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\n- CVE-2022-36109: Fixed a supplementary group permissions bypass (bsc#1205375).\n\nUpdate to 20.10.23-ce (https://docs.docker.com/engine/release-notes/#201023).\n\n- drop kubic flavor as kubic is EOL.\n\nUpdate to Docker 20.10.21-ce (https://docs.docker.com/engine/release-notes/#201021 bsc#1206065).\n\n- Fix wrong After: in docker.service, fixes bsc#1188447\n- Build with Go 1.18.\n","status":"published","published":"2023-03-28T10:05:29Z","modified":"2026-02-04T04:13:05.709379Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2025:03540-1","title":"Security update for docker-stable","description":"This update for docker-stable fixes the following issues:\n\n- Include historical changelog data from before the docker-stable fork. The\n  initial changelog entry did technically provide all the necessary\n  information, but our CVE tracking tools do not understand how the package is\n  forked and so it seems that this package does not include fixes for ~12 years\n  of updates. So, include a copy of the original package's changelog up until\n  the fork point. (bsc#1250596)\n\n- Remove git-core recommends on SLE. Most SLE systems have\n  installRecommends=yes by default and thus end up installing git with Docker.\n  bsc#1250508\n\n  This feature is mostly intended for developers ('docker build git://') so\n  most users already have the dependency installed, and the error when git is\n  missing is fairly straightforward (so they can easily figure out what they\n  need to install).\n\n- Backport \u003chttps://github.com/moby/moby/pull/48517\u003e. bsc#1247362\n\n- Update to docker-buildx v0.25.0. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.25.0\u003e\n\n- Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as\n  Docker does not have permission to access the host zypper credentials in this\n  mode (and unprivileged users cannot disable the feature using\n  /etc/docker/suse-secrets-enable.) bsc#1240150\n\n- Initial docker-stable fork, forked from Docker 24.0.7-ce release\n  (packaged on 2024-02-14). The original changelog is included below for\n  historical reference.\n","status":"published","published":"2025-10-10T19:04:02Z","modified":"2026-02-04T02:38:37.010407Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:03545-1","title":"Security update for docker-stable","description":"This update for docker-stable fixes the following issues:\n\nNote this update contains a already fixed references mostly.\n\n- Remove git-core recommends on SLE to avoid pulling it in unnecessary. (bsc#1250508)\n\n  This feature is mostly intended for developers ('docker build git://') so\n  most users already have the dependency installed, and the error when git is\n  missing is fairly straightforward (so they can easily figure out what they\n  need to install).\n\n- Include historical changelog data from before the docker-stable fork. The\n  initial changelog entry did technically provide all the necessary\n  information, but our CVE tracking tools do not understand how the package is\n  forked and so it seems that this package does not include fixes for ~12 years\n  of updates. So, include a copy of the original package's changelog up until\n  the fork point. bsc#1250596\n\n- Update to docker-buildx v0.25.0. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.25.0\u003e\n\n- Update to Go 1.23 for building now that upstream has switched their 23.0.x\n  LTSS to use Go 1.23.\n\n- Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as\n  Docker does not have permission to access the host zypper credentials in this\n  mode (and unprivileged users cannot disable the feature using\n  /etc/docker/suse-secrets-enable.) bsc#1240150\n\n- Initial docker-stable fork, forked from Docker 24.0.7-ce release\n  (packaged on 2024-02-14). The original changelog is included below for\n  historical reference.\n","status":"published","published":"2025-10-11T01:20:50Z","modified":"2026-03-23T04:48:05.17767Z","updated_at":"2026-11-02T15:53:58.883365Z"}]}}