{"id":"CVE-2024-29018","aliases":["AZL-36900","AZL-40034","BELL-CVE-2024-29018","DEBIAN-CVE-2024-29018","EUVD-2024-0966","GHSA-mq39-4gv4-mvpx","GO-2024-2659","MGASA-2025-0189","OESA-2024-1417","OESA-2024-1464","OESA-2024-1465","OESA-2024-1466","OESA-2024-1467","OESA-2024-1468","ROOT-OS-DEBIAN-12-CVE-2024-29018","SUSE-SU-2025:0226-1","SUSE-SU-2025:03540-1","SUSE-SU-2025:03545-1","SUSE-SU-2025:0776-1","SUSE-SU-2025:0992-1","SUSE-SU-2025:1062-1","SUSE-SU-2025:1102-1","SUSE-SU-2025:20205-1","SUSE-SU-2025:20259-1","SUSE-SU-2026:0972-1","SUSE-SU-2026:1118-1","UBUNTU-CVE-2024-29018","USN-7161-1","USN-7161-2","openSUSE-SU-2024:14597-1","openSUSE-SU-2024:14598-1"],"status":"published","title":"External DNS requests from 'internal' networks could lead to data exfiltration","description":"Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\n\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\n\nContainers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\n\nIn addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.\n\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container's network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\n\nAs a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\n\nMany systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host's configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.\n\nBecause `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.\n\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\n\nMoby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container's network namespace.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00744,"percentile":0.55085,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-669"],"published":"2024-03-20T17:59:52Z","modified":"2026-11-02T12:02:04Z","fixes":[{"ecosystem":"Go","package":"github.com/docker/docker","fixed_in":["26.0.0-rc3","25.0.5","23.0.11","25.0.5+incompatible","26.0.0-rc3+incompatible"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"moby-engine","fixed_in":["25.0.3-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"moby-engine","fixed_in":["24.0.9-9"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"docker","fixed_in":["26.0.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"docker.io","fixed_in":["26.1.4+dfsg1-9"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"docker.io","fixed_in":["26.1.4+dfsg1-9"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"docker","fixed_in":["25.0.7-1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"docker","fixed_in":["engine-18.09.0-264.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"docker","fixed_in":["engine-18.09.0-264.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"docker","fixed_in":["engine-18.09.0-334.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"docker","fixed_in":["engine-18.09.0-334.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"docker","fixed_in":["engine-18.09.0-334.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"docker","fixed_in":["engine-18.09.0-335.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"docker.io","fixed_in":["20.10.24+dfsg1-1+deb12u1.root.io.2","20.10.24+dfsg1-1+deb12u1.aikido.3","20.10.24+dfsg1-1+deb12u1.aikido.4","20.10.24+dfsg1-1+deb12u1.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-docker.io","fixed_in":["20.10.24+dfsg1-1+deb12u1.root.io.2","20.10.24+dfsg1-1+deb12u1.aikido.3","20.10.24+dfsg1-1+deb12u1.aikido.4","20.10.24+dfsg1-1+deb12u1.aikido.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"docker","fixed_in":["27.5.1_ce-150000.215.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"docker","fixed_in":["27.5.1_ce-150000.215.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"docker","fixed_in":["27.5.1_ce-150000.215.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"docker","fixed_in":["27.5.1_ce-150000.215.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"docker","fixed_in":["27.5.1_ce-150000.215.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"docker","fixed_in":["27.5.1_ce-150000.215.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"docker","fixed_in":["27.5.1_ce-150000.215.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"docker","fixed_in":["27.5.1_ce-98.123.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"docker.io","fixed_in":["18.09.7-0ubuntu1~16.04.9+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"docker.io","fixed_in":["20.10.21-0ubuntu1~18.04.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"docker.io-app","fixed_in":["26.1.3-0ubuntu1~20.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"docker.io-app","fixed_in":["27.5.1-0ubuntu3~22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"docker.io-app","fixed_in":["26.1.3-0ubuntu1~22.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"docker.io-app","fixed_in":["27.5.1-0ubuntu3~24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"docker.io-app","fixed_in":["26.1.3-0ubuntu1~24.04.1+esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"docker","fixed_in":["27.4.1_ce-12.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/docker/docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.0.0-rc1"},{"fixed":"26.0.0-rc3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/docker/docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0"},{"fixed":"25.0.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/docker/docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.3-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"moby-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9-9"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.10.21-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.4-r1"},{"fixed":"26.0.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.10.24+dfsg1-1","20.10.24+dfsg1-1+deb12u1","20.10.25+dfsg1-1","20.10.25+dfsg1-2","20.10.25+dfsg1-3","20.10.25+dfsg1-4","26.1.4+dfsg1-1","26.1.4+dfsg1-2","26.1.4+dfsg1-3","26.1.4+dfsg1-4","26.1.4+dfsg1-5","26.1.4+dfsg1-6","26.1.4+dfsg1-7","26.1.4+dfsg1-8","26.1.4+dfsg1-9","26.1.4+dfsg2-1","26.1.4+dfsg3-1","26.1.5+dfsg1-1","26.1.5+dfsg1-10","26.1.5+dfsg1-2","26.1.5+dfsg1-3","26.1.5+dfsg1-4","26.1.5+dfsg1-5","26.1.5+dfsg1-6","26.1.5+dfsg1-7","26.1.5+dfsg1-8","26.1.5+dfsg1-9","27.5.1+dfsg1-1","27.5.1+dfsg1-2","27.5.1+dfsg2-1","27.5.1+dfsg3-1","27.5.1+dfsg3-2","27.5.1+dfsg3-3","27.5.1+dfsg3-4","27.5.1+dfsg3-5","27.5.1+dfsg3-6","27.5.1+dfsg4-1","27.5.1+dfsg4-2","28.5.2+dfsg1-1","28.5.2+dfsg2-1","28.5.2+dfsg3-1","28.5.2+dfsg3-2","28.5.2+dfsg4-1","28.5.2+dfsg4-2","28.5.2+dfsg4-3","28.5.2+dfsg4-4","28.5.2+dfsg4-5"]},{"source":"osv","ecosystem":"Debian:13","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.4+dfsg1-9"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.4+dfsg1-9"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/docker/docker","ranges":[{"type":"SEMVER","events":[{"introduced":"26.0.0-rc1"},{"fixed":"26.0.0-rc3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/docker/docker","ranges":[{"type":"SEMVER","events":[{"introduced":"25.0.0"},{"fixed":"25.0.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/docker/docker","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"23.0.11"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/docker/docker","ranges":[{"type":"SEMVER","events":[{"introduced":"25.0.0+incompatible"},{"fixed":"25.0.5+incompatible"},{"introduced":"26.0.0-rc1+incompatible"},{"fixed":"26.0.0-rc3+incompatible"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.7-1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"engine-18.09.0-264.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"engine-18.09.0-264.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"engine-18.09.0-334.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"engine-18.09.0-334.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"engine-18.09.0-334.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"engine-18.09.0-335.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.24+dfsg1-1+deb12u1.root.io.2"},{"fixed":"20.10.24+dfsg1-1+deb12u1.aikido.3"},{"fixed":"20.10.24+dfsg1-1+deb12u1.aikido.4"},{"fixed":"20.10.24+dfsg1-1+deb12u1.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.24+dfsg1-1+deb12u1.root.io.2"},{"fixed":"20.10.24+dfsg1-1+deb12u1.aikido.3"},{"fixed":"20.10.24+dfsg1-1+deb12u1.aikido.4"},{"fixed":"20.10.24+dfsg1-1+deb12u1.aikido.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-1.20.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-1.20.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.25.1"}]}],"bundled":53},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.215.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.215.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.215.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.215.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.215.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.215.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.215.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-98.123.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-150000.218.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-98.126.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-1.11.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-98.126.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-1.11.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1_ce-slfo.1.1_1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.39.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-150000.1.39.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-1.32.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.7-0ubuntu1~16.04.9+esm2"}]}],"versions":["1.6.2~dfsg1-1ubuntu4","1.10.2-0ubuntu3","1.10.2-0ubuntu4","1.10.3-0ubuntu1","1.10.3-0ubuntu4","1.10.3-0ubuntu5","1.10.3-0ubuntu6","1.11.2-0ubuntu5~16.04","1.12.1-0ubuntu13~16.04.1","1.12.3-0ubuntu4~16.04.2","1.12.6-0ubuntu1~16.04.1","1.13.1-0ubuntu1~16.04.2","17.03.2-0ubuntu2~16.04.1","18.06.1-0ubuntu1~16.04.2","18.06.1-0ubuntu1.2~16.04.1","18.09.2-0ubuntu1~16.04.1","18.09.5-0ubuntu1~16.04.2","18.09.7-0ubuntu1~16.04.1","18.09.7-0ubuntu1~16.04.4","18.09.7-0ubuntu1~16.04.5","18.09.7-0ubuntu1~16.04.6","18.09.7-0ubuntu1~16.04.7","18.09.7-0ubuntu1~16.04.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.21-0ubuntu1~18.04.3+esm2"}]}],"versions":["1.13.1-0ubuntu6","17.03.2-0ubuntu1","17.03.2-0ubuntu3","17.03.2-0ubuntu5","17.12.1-0ubuntu1","18.06.1-0ubuntu1~18.04.1","18.06.1-0ubuntu1.2~18.04.1","18.09.2-0ubuntu1~18.04.1","18.09.5-0ubuntu1~18.04.2","18.09.7-0ubuntu1~18.04.1","18.09.7-0ubuntu1~18.04.3","18.09.7-0ubuntu1~18.04.4","19.03.6-0ubuntu1~18.04.1","19.03.6-0ubuntu1~18.04.2","19.03.6-0ubuntu1~18.04.3","20.10.2-0ubuntu1~18.04.2","20.10.2-0ubuntu1~18.04.3","20.10.7-0ubuntu1~18.04.1","20.10.7-0ubuntu1~18.04.2","20.10.7-0ubuntu5~18.04.2","20.10.7-0ubuntu5~18.04.3","20.10.12-0ubuntu2~18.04.1","20.10.21-0ubuntu1~18.04.2","20.10.21-0ubuntu1~18.04.3","20.10.21-0ubuntu1~18.04.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["19.03.2-0ubuntu1","19.03.6-0ubuntu1","19.03.8-0ubuntu1","19.03.8-0ubuntu1.20.04","19.03.8-0ubuntu1.20.04.1","19.03.8-0ubuntu1.20.04.2","20.10.2-0ubuntu1~20.04.2","20.10.2-0ubuntu1~20.04.3","20.10.7-0ubuntu1~20.04.1","20.10.7-0ubuntu1~20.04.2","20.10.7-0ubuntu5~20.04.1","20.10.7-0ubuntu5~20.04.2","20.10.12-0ubuntu2~20.04.1","20.10.21-0ubuntu1~20.04.1","20.10.21-0ubuntu1~20.04.2","20.10.21-0ubuntu1~20.04.4","20.10.21-0ubuntu1~20.04.5","20.10.21-0ubuntu1~20.04.6","20.10.21-0ubuntu1~20.04.6+esm1","20.10.21-0ubuntu1~20.04.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"docker.io-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.3-0ubuntu1~20.04.1+esm1"}]}],"versions":["20.10.25-0ubuntu1~20.04.1","20.10.25-0ubuntu1~20.04.2","24.0.5-0ubuntu1~20.04.1","24.0.7-0ubuntu2~20.04.1","26.1.3-0ubuntu1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.10.7-0ubuntu5","20.10.7-0ubuntu7","20.10.12-0ubuntu1","20.10.12-0ubuntu2","20.10.12-0ubuntu3","20.10.12-0ubuntu3+gke1.24.1","20.10.12-0ubuntu4","20.10.21-0ubuntu1~22.04.2","20.10.21-0ubuntu1~22.04.3","20.10.21-0ubuntu1~22.04.5","20.10.21-0ubuntu1~22.04.6","20.10.21-0ubuntu1~22.04.7","20.10.21-0ubuntu1~22.04.8"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"docker.io-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1-0ubuntu3~22.04.2"}]}],"versions":["20.10.25-0ubuntu1~22.04.1","20.10.25-0ubuntu1~22.04.2","24.0.5-0ubuntu1~22.04.1","24.0.7-0ubuntu2~22.04.1","26.1.3-0ubuntu1~22.04.1","27.5.1-0ubuntu3~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"docker.io-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.3-0ubuntu1~22.04.1+esm1"}]}],"versions":["20.10.25-0ubuntu1~22.04.1","20.10.25-0ubuntu1~22.04.2","24.0.5-0ubuntu1~22.04.1","24.0.7-0ubuntu2~22.04.1","26.1.3-0ubuntu1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.10.24+dfsg1-1ubuntu2","20.10.25+dfsg1-2ubuntu1","20.10.25+dfsg1-2ubuntu1.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"docker.io-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.5.1-0ubuntu3~24.04.2"}]}],"versions":["24.0.5-0ubuntu1","24.0.7-0ubuntu1","24.0.7-0ubuntu2","24.0.7-0ubuntu3","24.0.7-0ubuntu4","24.0.7-0ubuntu4.1","26.1.3-0ubuntu1~24.04.1","27.5.1-0ubuntu3~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"docker.io-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.3-0ubuntu1~24.04.1+esm1"}]}],"versions":["24.0.5-0ubuntu1","24.0.7-0ubuntu1","24.0.7-0ubuntu2","24.0.7-0ubuntu3","24.0.7-0ubuntu4","24.0.7-0ubuntu4.1","26.1.3-0ubuntu1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.21-0ubuntu1~18.04.3+esm1"}]}],"versions":["1.13.1-0ubuntu6","17.03.2-0ubuntu1","17.03.2-0ubuntu3","17.03.2-0ubuntu5","17.12.1-0ubuntu1","18.06.1-0ubuntu1~18.04.1","18.06.1-0ubuntu1.2~18.04.1","18.09.2-0ubuntu1~18.04.1","18.09.5-0ubuntu1~18.04.2","18.09.7-0ubuntu1~18.04.1","18.09.7-0ubuntu1~18.04.3","18.09.7-0ubuntu1~18.04.4","19.03.6-0ubuntu1~18.04.1","19.03.6-0ubuntu1~18.04.2","19.03.6-0ubuntu1~18.04.3","20.10.2-0ubuntu1~18.04.2","20.10.2-0ubuntu1~18.04.3","20.10.7-0ubuntu1~18.04.1","20.10.7-0ubuntu1~18.04.2","20.10.7-0ubuntu5~18.04.2","20.10.7-0ubuntu5~18.04.3","20.10.12-0ubuntu2~18.04.1","20.10.21-0ubuntu1~18.04.2","20.10.21-0ubuntu1~18.04.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"docker.io-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.3-0ubuntu1~24.04.1+esm1"}]}],"versions":["24.0.5-0ubuntu1","24.0.7-0ubuntu1","24.0.7-0ubuntu2","24.0.7-0ubuntu3","24.0.7-0ubuntu4","24.0.7-0ubuntu4.1","26.1.3-0ubuntu1~24.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.7-0ubuntu1~16.04.9+esm2"}]}],"versions":["1.6.2~dfsg1-1ubuntu4","1.10.2-0ubuntu3","1.10.2-0ubuntu4","1.10.3-0ubuntu1","1.10.3-0ubuntu4","1.10.3-0ubuntu5","1.10.3-0ubuntu6","1.11.2-0ubuntu5~16.04","1.12.1-0ubuntu13~16.04.1","1.12.3-0ubuntu4~16.04.2","1.12.6-0ubuntu1~16.04.1","1.13.1-0ubuntu1~16.04.2","17.03.2-0ubuntu2~16.04.1","18.06.1-0ubuntu1~16.04.2","18.06.1-0ubuntu1.2~16.04.1","18.09.2-0ubuntu1~16.04.1","18.09.5-0ubuntu1~16.04.2","18.09.7-0ubuntu1~16.04.1","18.09.7-0ubuntu1~16.04.4","18.09.7-0ubuntu1~16.04.5","18.09.7-0ubuntu1~16.04.6","18.09.7-0ubuntu1~16.04.7","18.09.7-0ubuntu1~16.04.9+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.21-0ubuntu1~18.04.3+esm2"}]}],"versions":["1.13.1-0ubuntu6","17.03.2-0ubuntu1","17.03.2-0ubuntu3","17.03.2-0ubuntu5","17.12.1-0ubuntu1","18.06.1-0ubuntu1~18.04.1","18.06.1-0ubuntu1.2~18.04.1","18.09.2-0ubuntu1~18.04.1","18.09.5-0ubuntu1~18.04.2","18.09.7-0ubuntu1~18.04.1","18.09.7-0ubuntu1~18.04.3","18.09.7-0ubuntu1~18.04.4","19.03.6-0ubuntu1~18.04.1","19.03.6-0ubuntu1~18.04.2","19.03.6-0ubuntu1~18.04.3","20.10.2-0ubuntu1~18.04.2","20.10.2-0ubuntu1~18.04.3","20.10.7-0ubuntu1~18.04.1","20.10.7-0ubuntu1~18.04.2","20.10.7-0ubuntu5~18.04.2","20.10.7-0ubuntu5~18.04.3","20.10.12-0ubuntu2~18.04.1","20.10.21-0ubuntu1~18.04.2","20.10.21-0ubuntu1~18.04.3","20.10.21-0ubuntu1~18.04.3+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"docker.io-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.3-0ubuntu1~20.04.1+esm1"}]}],"versions":["20.10.25-0ubuntu1~20.04.1","20.10.25-0ubuntu1~20.04.2","24.0.5-0ubuntu1~20.04.1","24.0.7-0ubuntu2~20.04.1","26.1.3-0ubuntu1~20.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"docker.io-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.1.3-0ubuntu1~22.04.1+esm1"}]}],"versions":["20.10.25-0ubuntu1~22.04.1","20.10.25-0ubuntu1~22.04.2","24.0.5-0ubuntu1~22.04.1","24.0.7-0ubuntu2~22.04.1","26.1.3-0ubuntu1~22.04.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.4.1_ce-12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"docker-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.9_ce-6.1"}]}],"bundled":3}],"products":[{"vendor":"moby","product":"moby"},{"vendor":"mobyproject","product":"moby"}],"references":[{"url":"https://github.com/moby/moby/security/advisories/GHSA-mq39-4gv4-mvpx","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/moby/moby/pull/46609","tags":["x_refsource_MISC","x_transferred","Issue Tracking","fix","web","report"]},{"url":"https://github.com/advisories/GHSA-mq39-4gv4-mvpx"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29018","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-29018","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29018.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-29018","tags":["advisory"]},{"url":"https://github.com/moby/moby","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0189.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33870","tags":["report"]},{"url":"https://github.com/moby/moby/releases/tag/v25.0.7","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1417","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1464","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1465","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1466","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1467","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1468","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250226-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219437","tags":["report"]},{"url":"https://bugzilla.suse.com/1234089","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41110","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503540-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1001161","tags":["report"]},{"url":"https://bugzilla.suse.com/1004490","tags":["report"]},{"url":"https://bugzilla.suse.com/1007249","tags":["report"]},{"url":"https://bugzilla.suse.com/1009961","tags":["report"]},{"url":"https://bugzilla.suse.com/1012568","tags":["report"]},{"url":"https://bugzilla.suse.com/1015661","tags":["report"]},{"url":"https://bugzilla.suse.com/1016307","tags":["report"]},{"url":"https://bugzilla.suse.com/1016992","tags":["report"]},{"url":"https://bugzilla.suse.com/1019251","tags":["report"]},{"url":"https://bugzilla.suse.com/1020806","tags":["report"]},{"url":"https://bugzilla.suse.com/1021227","tags":["report"]},{"url":"https://bugzilla.suse.com/1026827","tags":["report"]},{"url":"https://bugzilla.suse.com/1028638","tags":["report"]},{"url":"https://bugzilla.suse.com/1028639","tags":["report"]},{"url":"https://bugzilla.suse.com/1029320","tags":["report"]},{"url":"https://bugzilla.suse.com/1029630","tags":["report"]},{"url":"https://bugzilla.suse.com/1030702","tags":["report"]},{"url":"https://bugzilla.suse.com/1032287","tags":["report"]},{"url":"https://bugzilla.suse.com/1032644","tags":["report"]},{"url":"https://bugzilla.suse.com/1034053","tags":["report"]},{"url":"https://bugzilla.suse.com/1034063","tags":["report"]},{"url":"https://bugzilla.suse.com/1037436","tags":["report"]},{"url":"https://bugzilla.suse.com/1037607","tags":["report"]},{"url":"https://bugzilla.suse.com/1038476","tags":["report"]},{"url":"https://bugzilla.suse.com/1038493","tags":["report"]},{"url":"https://bugzilla.suse.com/1045628","tags":["report"]},{"url":"https://bugzilla.suse.com/1046024","tags":["report"]},{"url":"https://bugzilla.suse.com/1047218","tags":["report"]},{"url":"https://bugzilla.suse.com/1048046","tags":["report"]},{"url":"https://bugzilla.suse.com/1051429","tags":["report"]},{"url":"https://bugzilla.suse.com/1055676","tags":["report"]},{"url":"https://bugzilla.suse.com/1057743","tags":["report"]},{"url":"https://bugzilla.suse.com/1058173","tags":["report"]},{"url":"https://bugzilla.suse.com/1059011","tags":["report"]},{"url":"https://bugzilla.suse.com/1064781","tags":["report"]},{"url":"https://bugzilla.suse.com/1065609","tags":["report"]},{"url":"https://bugzilla.suse.com/1066210","tags":["report"]},{"url":"https://bugzilla.suse.com/1066801","tags":["report"]},{"url":"https://bugzilla.suse.com/1069468","tags":["report"]},{"url":"https://bugzilla.suse.com/1069758","tags":["report"]},{"url":"https://bugzilla.suse.com/1072798","tags":["report"]},{"url":"https://bugzilla.suse.com/1073877","tags":["report"]},{"url":"https://bugzilla.suse.com/1074971","tags":["report"]},{"url":"https://bugzilla.suse.com/1080978","tags":["report"]},{"url":"https://bugzilla.suse.com/1084533","tags":["report"]},{"url":"https://bugzilla.suse.com/1085117","tags":["report"]},{"url":"https://bugzilla.suse.com/1085380","tags":["report"]},{"url":"https://bugzilla.suse.com/1086185","tags":["report"]},{"url":"https://bugzilla.suse.com/1089732","tags":["report"]},{"url":"https://bugzilla.suse.com/1095817","tags":["report"]},{"url":"https://bugzilla.suse.com/1096726","tags":["report"]},{"url":"https://bugzilla.suse.com/1099277","tags":["report"]},{"url":"https://bugzilla.suse.com/1100331","tags":["report"]},{"url":"https://bugzilla.suse.com/1100727","tags":["report"]},{"url":"https://bugzilla.suse.com/1102522","tags":["report"]},{"url":"https://bugzilla.suse.com/1104821","tags":["report"]},{"url":"https://bugzilla.suse.com/1105000","tags":["report"]},{"url":"https://bugzilla.suse.com/1108038","tags":["report"]},{"url":"https://bugzilla.suse.com/1112980","tags":["report"]},{"url":"https://bugzilla.suse.com/1113313","tags":["report"]},{"url":"https://bugzilla.suse.com/1114832","tags":["report"]},{"url":"https://bugzilla.suse.com/1115464","tags":["report"]},{"url":"https://bugzilla.suse.com/1118897","tags":["report"]},{"url":"https://bugzilla.suse.com/1118898","tags":["report"]},{"url":"https://bugzilla.suse.com/1118899","tags":["report"]},{"url":"https://bugzilla.suse.com/1118990","tags":["report"]},{"url":"https://bugzilla.suse.com/1119634","tags":["report"]},{"url":"https://bugzilla.suse.com/1121412","tags":["report"]},{"url":"https://bugzilla.suse.com/1121768","tags":["report"]},{"url":"https://bugzilla.suse.com/1122469","tags":["report"]},{"url":"https://bugzilla.suse.com/1124308","tags":["report"]},{"url":"https://bugzilla.suse.com/1128376","tags":["report"]},{"url":"https://bugzilla.suse.com/1128746","tags":["report"]},{"url":"https://bugzilla.suse.com/1134068","tags":["report"]},{"url":"https://bugzilla.suse.com/1138920","tags":["report"]},{"url":"https://bugzilla.suse.com/1139649","tags":["report"]},{"url":"https://bugzilla.suse.com/1142160","tags":["report"]},{"url":"https://bugzilla.suse.com/1142413","tags":["report"]},{"url":"https://bugzilla.suse.com/1143349","tags":["report"]},{"url":"https://bugzilla.suse.com/1150397","tags":["report"]},{"url":"https://bugzilla.suse.com/1153367","tags":["report"]},{"url":"https://bugzilla.suse.com/1157330","tags":["report"]},{"url":"https://bugzilla.suse.com/1158590","tags":["report"]},{"url":"https://bugzilla.suse.com/1170415","tags":["report"]},{"url":"https://bugzilla.suse.com/1170446","tags":["report"]},{"url":"https://bugzilla.suse.com/1172377","tags":["report"]},{"url":"https://bugzilla.suse.com/1174075","tags":["report"]},{"url":"https://bugzilla.suse.com/1175081","tags":["report"]},{"url":"https://bugzilla.suse.com/1176708","tags":["report"]},{"url":"https://bugzilla.suse.com/1178760","tags":["report"]},{"url":"https://bugzilla.suse.com/1178801","tags":["report"]},{"url":"https://bugzilla.suse.com/1180243","tags":["report"]},{"url":"https://bugzilla.suse.com/1180401","tags":["report"]},{"url":"https://bugzilla.suse.com/1181594","tags":["report"]},{"url":"https://bugzilla.suse.com/1181641","tags":["report"]},{"url":"https://bugzilla.suse.com/1181677","tags":["report"]},{"url":"https://bugzilla.suse.com/1181730","tags":["report"]},{"url":"https://bugzilla.suse.com/1181732","tags":["report"]},{"url":"https://bugzilla.suse.com/1182168","tags":["report"]},{"url":"https://bugzilla.suse.com/1182476","tags":["report"]},{"url":"https://bugzilla.suse.com/1182947","tags":["report"]},{"url":"https://bugzilla.suse.com/1183855","tags":["report"]},{"url":"https://bugzilla.suse.com/1184768","tags":["report"]},{"url":"https://bugzilla.suse.com/1188447","tags":["report"]},{"url":"https://bugzilla.suse.com/1190670","tags":["report"]},{"url":"https://bugzilla.suse.com/1191015","tags":["report"]},{"url":"https://bugzilla.suse.com/1191121","tags":["report"]},{"url":"https://bugzilla.suse.com/1191334","tags":["report"]},{"url":"https://bugzilla.suse.com/1191355","tags":["report"]},{"url":"https://bugzilla.suse.com/1191434","tags":["report"]},{"url":"https://bugzilla.suse.com/1192814","tags":["report"]},{"url":"https://bugzilla.suse.com/1193273","tags":["report"]},{"url":"https://bugzilla.suse.com/1193930","tags":["report"]},{"url":"https://bugzilla.suse.com/1197284","tags":["report"]},{"url":"https://bugzilla.suse.com/1197517","tags":["report"]},{"url":"https://bugzilla.suse.com/1200022","tags":["report"]},{"url":"https://bugzilla.suse.com/1200145","tags":["report"]},{"url":"https://bugzilla.suse.com/1205375","tags":["report"]},{"url":"https://bugzilla.suse.com/1206065","tags":["report"]},{"url":"https://bugzilla.suse.com/1208074","tags":["report"]},{"url":"https://bugzilla.suse.com/1210141","tags":["report"]},{"url":"https://bugzilla.suse.com/1210797","tags":["report"]},{"url":"https://bugzilla.suse.com/1211578","tags":["report"]},{"url":"https://bugzilla.suse.com/1212368","tags":["report"]},{"url":"https://bugzilla.suse.com/1213120","tags":["report"]},{"url":"https://bugzilla.suse.com/1213229","tags":["report"]},{"url":"https://bugzilla.suse.com/1213500","tags":["report"]},{"url":"https://bugzilla.suse.com/1214107","tags":["report"]},{"url":"https://bugzilla.suse.com/1214108","tags":["report"]},{"url":"https://bugzilla.suse.com/1214109","tags":["report"]},{"url":"https://bugzilla.suse.com/1215323","tags":["report"]},{"url":"https://bugzilla.suse.com/1217513","tags":["report"]},{"url":"https://bugzilla.suse.com/1219267","tags":["report"]},{"url":"https://bugzilla.suse.com/1219268","tags":["report"]},{"url":"https://bugzilla.suse.com/1219438","tags":["report"]},{"url":"https://bugzilla.suse.com/1240150","tags":["report"]},{"url":"https://bugzilla.suse.com/1247362","tags":["report"]},{"url":"https://bugzilla.suse.com/1250508","tags":["report"]},{"url":"https://bugzilla.suse.com/1250596","tags":["report"]},{"url":"https://bugzilla.suse.com/885209","tags":["report"]},{"url":"https://bugzilla.suse.com/907012","tags":["report"]},{"url":"https://bugzilla.suse.com/907014","tags":["report"]},{"url":"https://bugzilla.suse.com/908033","tags":["report"]},{"url":"https://bugzilla.suse.com/909709","tags":["report"]},{"url":"https://bugzilla.suse.com/909710","tags":["report"]},{"url":"https://bugzilla.suse.com/909712","tags":["report"]},{"url":"https://bugzilla.suse.com/913211","tags":["report"]},{"url":"https://bugzilla.suse.com/913213","tags":["report"]},{"url":"https://bugzilla.suse.com/920645","tags":["report"]},{"url":"https://bugzilla.suse.com/930235","tags":["report"]},{"url":"https://bugzilla.suse.com/931301","tags":["report"]},{"url":"https://bugzilla.suse.com/935570","tags":["report"]},{"url":"https://bugzilla.suse.com/938156","tags":["report"]},{"url":"https://bugzilla.suse.com/942369","tags":["report"]},{"url":"https://bugzilla.suse.com/942370","tags":["report"]},{"url":"https://bugzilla.suse.com/946653","tags":["report"]},{"url":"https://bugzilla.suse.com/949660","tags":["report"]},{"url":"https://bugzilla.suse.com/950931","tags":["report"]},{"url":"https://bugzilla.suse.com/953182","tags":["report"]},{"url":"https://bugzilla.suse.com/954737","tags":["report"]},{"url":"https://bugzilla.suse.com/954797","tags":["report"]},{"url":"https://bugzilla.suse.com/954812","tags":["report"]},{"url":"https://bugzilla.suse.com/956434","tags":["report"]},{"url":"https://bugzilla.suse.com/958255","tags":["report"]},{"url":"https://bugzilla.suse.com/959405","tags":["report"]},{"url":"https://bugzilla.suse.com/963142","tags":["report"]},{"url":"https://bugzilla.suse.com/964468","tags":["report"]},{"url":"https://bugzilla.suse.com/964673","tags":["report"]},{"url":"https://bugzilla.suse.com/965600","tags":["report"]},{"url":"https://bugzilla.suse.com/965918","tags":["report"]},{"url":"https://bugzilla.suse.com/968933","tags":["report"]},{"url":"https://bugzilla.suse.com/968972","tags":["report"]},{"url":"https://bugzilla.suse.com/970637","tags":["report"]},{"url":"https://bugzilla.suse.com/974208","tags":["report"]},{"url":"https://bugzilla.suse.com/976777","tags":["report"]},{"url":"https://bugzilla.suse.com/977394","tags":["report"]},{"url":"https://bugzilla.suse.com/978260","tags":["report"]},{"url":"https://bugzilla.suse.com/980555","tags":["report"]},{"url":"https://bugzilla.suse.com/983015","tags":["report"]},{"url":"https://bugzilla.suse.com/984942","tags":["report"]},{"url":"https://bugzilla.suse.com/987198","tags":["report"]},{"url":"https://bugzilla.suse.com/988408","tags":["report"]},{"url":"https://bugzilla.suse.com/988707","tags":["report"]},{"url":"https://bugzilla.suse.com/989566","tags":["report"]},{"url":"https://bugzilla.suse.com/993847","tags":["report"]},{"url":"https://bugzilla.suse.com/995058","tags":["report"]},{"url":"https://bugzilla.suse.com/995102","tags":["report"]},{"url":"https://bugzilla.suse.com/995620","tags":["report"]},{"url":"https://bugzilla.suse.com/996015","tags":["report"]},{"url":"https://bugzilla.suse.com/999582","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503545-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250776-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237335","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250992-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251062-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237367","tags":["report"]},{"url":"https://bugzilla.suse.com/1239185","tags":["report"]},{"url":"https://bugzilla.suse.com/1239322","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251102-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520205-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223409","tags":["report"]},{"url":"https://bugzilla.suse.com/1239765","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0495","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520259-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1217070","tags":["report"]},{"url":"https://bugzilla.suse.com/1228324","tags":["report"]},{"url":"https://bugzilla.suse.com/1228553","tags":["report"]},{"url":"https://bugzilla.suse.com/1229806","tags":["report"]},{"url":"https://bugzilla.suse.com/1230294","tags":["report"]},{"url":"https://bugzilla.suse.com/1230331","tags":["report"]},{"url":"https://bugzilla.suse.com/1230333","tags":["report"]},{"url":"https://bugzilla.suse.com/1231348","tags":["report"]},{"url":"https://bugzilla.suse.com/1232999","tags":["report"]},{"url":"https://bugzilla.suse.com/1233819","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47108","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260972-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253904","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261118-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-29018","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-29018","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7161-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7161-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-41110","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NQV4EZSYKG44SJCC2XH72E7WLVFELCEO/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2365","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-29018","title":"External DNS requests from 'internal' networks could lead to data exfiltration","description":"Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\n\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\n\nContainers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\n\nIn addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.\n\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container's network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\n\nAs a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\n\nMany systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host's configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.\n\nBecause `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.\n\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\n\nMoby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container's network namespace.","status":"published","published":"2024-03-20T20:27:00.491Z","modified":"2024-08-13T17:00:25.512Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T14:34:15.337999Z"}],"euvd":[{"id":"EUVD-2024-0966","description":"Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\n\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\n\nContainers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\n\nIn addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.\n\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container's network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\n\nAs a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\n\nMany systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host's configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.\n\nBecause `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.\n\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\n\nMoby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container's network namespace.","status":"published","published":"2024-03-20T20:27:00Z","modified":"2024-08-13T17:00:25Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:56:19.192984Z"}],"ghsa":[{"id":"GHSA-mq39-4gv4-mvpx","title":"Moby's external DNS requests from 'internal' networks could lead to data exfiltration","description":"Moby is an open source container framework originally developed by Docker Inc. as Docker. It is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. As a batteries-included container runtime, Moby comes with a built-in networking implementation that enables communication between containers, and between containers and external resources.\n\nMoby's networking implementation allows for creating and using many networks, each with their own subnet and gateway. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters, and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\n\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses (typically from a non-routable [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918) subnet). The root network namespace (hereafter referred to as the 'host') serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\n\nContainers on an _internal_ network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\n\nIn addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery (looking up other containers on the network by name), and resolution of names from an upstream resolver.\n\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver (by default, the host's configured resolver). This request is made from the container network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\n\nAs a consequence of this design, containers solely attached to _internal_ network(s) will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\n\nMany systems will run a local forwarding DNS resolver, typically present on a loopback address (`127.0.0.0/8`), such as systemd-resolved or dnsmasq. Common loopback address examples include `127.0.0.1` or `127.0.0.53`. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host's configured resolver, as they cannot reach these addresses on the host loopback device.\n\nTo bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` will detect this scenario and instead forward DNS requests from the host/root network namespace. The loopback resolver will then forward the requests to its configured upstream resolvers, as expected.\n\n## Impact\n\nBecause `dockerd` will forward DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics entirely, _internal_ networks can unexpectedly forward DNS requests to an external nameserver.\n\nBy registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers. For example, if the domain `evil.example` was registered, the authoritative nameserver(s) for that domain could (eventually and indirectly) receive a request for `this-is-a-secret.evil.example`.\n\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\n\n## Patches\n\nMoby releases 26.0.0-rc3, 25.0.5 (released) and 23.0.11 (to be released) are patched to prevent forwarding DNS requests from internal networks.\n\n## Workarounds\n\n-   Run containers intended to be solely attached to _internal_ networks with a custom upstream address (`--dns` argument to `docker run`, or API equivalent), which will force all upstream DNS queries to be resolved from the container network namespace.\n\n## Background\n\n- yair zak originally reported this issue to the Docker security team.\n-  PR \u003chttps://github.com/moby/moby/pull/46609\u003e was opened in public to fix this issue, as it was not originally considered to have a security implication.\n- [The official documentation](https://docs.docker.com/network/drivers/ipvlan/#:~:text=If%20the%20parent,the%20network%20completely) claims that \"the `--internal` flag that will completely isolate containers on a network from any communications external to that network,\" which necessitated this advisory and CVE.","status":"published","published":"2024-03-20T17:59:52Z","modified":"2024-03-20T17:59:53Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T14:37:41.821668Z"}],"nvd":[{"id":"CVE-2024-29018","description":"Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\n\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\n\nContainers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\n\nIn addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.\n\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container's network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\n\nAs a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\n\nMany systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host's configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.\n\nBecause `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.\n\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\n\nMoby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container's network namespace.","status":"published","published":"2024-03-20T21:15:31.113Z","modified":"2026-06-17T07:22:15.72Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T14:09:41.654534Z"}],"osv":[{"id":"AZL-36900","title":"CVE-2024-29018 affecting package moby-engine for versions less than 25.0.3-6","description":"Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\n\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\n\nContainers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\n\nIn addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.\n\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container's network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\n\nAs a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\n\nMany systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host's configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.\n\nBecause `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.\n\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\n\nMoby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container's network namespace.","status":"published","published":"2024-03-20T21:15:31Z","modified":"2026-10-31T15:02:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-40034","title":"CVE-2024-29018 affecting package moby-engine for versions less than 24.0.9-9","description":"Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\n\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\n\nContainers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\n\nIn addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.\n\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container's network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\n\nAs a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\n\nMany systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host's configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.\n\nBecause `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.\n\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\n\nMoby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container's network namespace.","status":"published","published":"2024-03-20T21:15:31Z","modified":"2026-04-21T04:28:54.006244Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"BELL-CVE-2024-29018","status":"published","published":"2024-03-22T05:56:48.878869Z","modified":"2026-01-26T09:36:31.102431Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:19.66992Z"},{"id":"CVE-2024-29018","title":"External DNS requests from 'internal' networks could lead to data exfiltration","description":"Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\n\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\n\nContainers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\n\nIn addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.\n\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container's network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\n\nAs a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\n\nMany systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host's configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.\n\nBecause `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.\n\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\n\nMoby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container's network namespace.","status":"published","published":"2024-03-20T20:27:00.491Z","modified":"2026-10-28T02:30:34.269122764Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"DEBIAN-CVE-2024-29018","description":"Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.  When containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.  Containers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.  In addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.  When a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container's network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.  As a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.  Many systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host's configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.  Because `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.  Docker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.  Moby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container's network namespace.","status":"published","published":"2024-03-20T21:15:31.113Z","modified":"2026-11-02T12:02:04.9115406Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-mq39-4gv4-mvpx","title":"Moby's external DNS requests from 'internal' networks could lead to data exfiltration","description":"Moby is an open source container framework originally developed by Docker Inc. as Docker. It is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. As a batteries-included container runtime, Moby comes with a built-in networking implementation that enables communication between containers, and between containers and external resources.\n\nMoby's networking implementation allows for creating and using many networks, each with their own subnet and gateway. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters, and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\n\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses (typically from a non-routable [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918) subnet). The root network namespace (hereafter referred to as the 'host') serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\n\nContainers on an _internal_ network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\n\nIn addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery (looking up other containers on the network by name), and resolution of names from an upstream resolver.\n\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver (by default, the host's configured resolver). This request is made from the container network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\n\nAs a consequence of this design, containers solely attached to _internal_ network(s) will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\n\nMany systems will run a local forwarding DNS resolver, typically present on a loopback address (`127.0.0.0/8`), such as systemd-resolved or dnsmasq. Common loopback address examples include `127.0.0.1` or `127.0.0.53`. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host's configured resolver, as they cannot reach these addresses on the host loopback device.\n\nTo bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` will detect this scenario and instead forward DNS requests from the host/root network namespace. The loopback resolver will then forward the requests to its configured upstream resolvers, as expected.\n\n## Impact\n\nBecause `dockerd` will forward DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics entirely, _internal_ networks can unexpectedly forward DNS requests to an external nameserver.\n\nBy registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers. For example, if the domain `evil.example` was registered, the authoritative nameserver(s) for that domain could (eventually and indirectly) receive a request for `this-is-a-secret.evil.example`.\n\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\n\n## Patches\n\nMoby releases 26.0.0-rc3, 25.0.5 (released) and 23.0.11 (to be released) are patched to prevent forwarding DNS requests from internal networks.\n\n## Workarounds\n\n-   Run containers intended to be solely attached to _internal_ networks with a custom upstream address (`--dns` argument to `docker run`, or API equivalent), which will force all upstream DNS queries to be resolved from the container network namespace.\n\n## Background\n\n- yair zak originally reported this issue to the Docker security team.\n-  PR \u003chttps://github.com/moby/moby/pull/46609\u003e was opened in public to fix this issue, as it was not originally considered to have a security implication.\n- [The official documentation](https://docs.docker.com/network/drivers/ipvlan/#:~:text=If%20the%20parent,the%20network%20completely) claims that \"the `--internal` flag that will completely isolate containers on a network from any communications external to that network,\" which necessitated this advisory and CVE.","status":"published","published":"2024-03-20T17:59:52Z","modified":"2026-09-10T03:50:10.643197011Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"OESA-2024-1417","title":"docker security update","description":"Docker is an open source project to build, ship and run any application as a lightweight container.\r\n\r\nSecurity Fix(es):\r\n\r\nMoby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby\u0026apos;s networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\r\n\r\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\r\n\r\nContainers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\r\n\r\nIn addition to configuring the Linux kernel\u0026apos;s various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.\r\n\r\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container\u0026apos;s network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\r\n\r\nAs a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\r\n\r\nMany systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host\u0026apos;s configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.\r\n\r\nBecause `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace\u0026apos;s normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.\r\n\r\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\r\n\r\nMoby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container\u0026apos;s network namespace.(CVE-2024-29018)","status":"published","published":"2024-04-12T11:06:51Z","modified":"2026-08-18T01:18:21.399533204Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1464","title":"docker security update","description":"Docker is an open source project to build, ship and run any application as a lightweight container.\r\n\r\nSecurity Fix(es):\r\n\r\nMoby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby\u0026apos;s networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\r\n\r\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\r\n\r\nContainers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\r\n\r\nIn addition to configuring the Linux kernel\u0026apos;s various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.\r\n\r\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container\u0026apos;s network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\r\n\r\nAs a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\r\n\r\nMany systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host\u0026apos;s configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.\r\n\r\nBecause `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace\u0026apos;s normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.\r\n\r\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\r\n\r\nMoby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container\u0026apos;s network namespace.(CVE-2024-29018)","status":"published","published":"2024-04-19T11:06:54Z","modified":"2026-08-18T01:18:23.740082435Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1465","title":"docker security update","description":"Docker is an open source project to build, ship and run any application as a lightweight container.\r\n\r\nSecurity Fix(es):\r\n\r\nMoby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby\u0026apos;s networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\r\n\r\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\r\n\r\nContainers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\r\n\r\nIn addition to configuring the Linux kernel\u0026apos;s various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.\r\n\r\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container\u0026apos;s network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\r\n\r\nAs a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\r\n\r\nMany systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host\u0026apos;s configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.\r\n\r\nBecause `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace\u0026apos;s normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.\r\n\r\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\r\n\r\nMoby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container\u0026apos;s network namespace.(CVE-2024-29018)","status":"published","published":"2024-04-19T11:06:54Z","modified":"2026-08-18T01:18:22.041656932Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1466","title":"docker security update","description":"Docker is an open source project to build, ship and run any application as a lightweight container.\r\n\r\nSecurity Fix(es):\r\n\r\nMoby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby\u0026apos;s networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\r\n\r\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\r\n\r\nContainers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\r\n\r\nIn addition to configuring the Linux kernel\u0026apos;s various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.\r\n\r\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container\u0026apos;s network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\r\n\r\nAs a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\r\n\r\nMany systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host\u0026apos;s configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.\r\n\r\nBecause `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace\u0026apos;s normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.\r\n\r\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\r\n\r\nMoby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container\u0026apos;s network namespace.(CVE-2024-29018)","status":"published","published":"2024-04-19T11:06:54Z","modified":"2026-08-18T01:18:24.30456196Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1467","title":"docker security update","description":"Docker is an open source project to build, ship and run any application as a lightweight container.\r\n\r\nSecurity Fix(es):\r\n\r\nMoby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby\u0026apos;s networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\r\n\r\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\r\n\r\nContainers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\r\n\r\nIn addition to configuring the Linux kernel\u0026apos;s various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.\r\n\r\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container\u0026apos;s network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\r\n\r\nAs a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\r\n\r\nMany systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host\u0026apos;s configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.\r\n\r\nBecause `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace\u0026apos;s normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.\r\n\r\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\r\n\r\nMoby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container\u0026apos;s network namespace.(CVE-2024-29018)","status":"published","published":"2024-04-19T11:06:54Z","modified":"2026-08-18T01:18:23.602194603Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1468","title":"docker security update","description":"Docker is an open source project to build, ship and run any application as a lightweight container.\r\n\r\nSecurity Fix(es):\r\n\r\nMoby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby\u0026apos;s networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\r\n\r\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\r\n\r\nContainers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\r\n\r\nIn addition to configuring the Linux kernel\u0026apos;s various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.\r\n\r\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container\u0026apos;s network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\r\n\r\nAs a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\r\n\r\nMany systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host\u0026apos;s configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.\r\n\r\nBecause `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace\u0026apos;s normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.\r\n\r\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\r\n\r\nMoby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container\u0026apos;s network namespace.(CVE-2024-29018)","status":"published","published":"2024-04-19T11:06:54Z","modified":"2026-08-18T01:18:24.228377006Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-29018","title":"CVE-2024-29018 in docker.io - Patched by Root","description":"Root has patched CVE-2024-29018 in the docker.io package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T09:26:18Z","modified":"2026-08-26T01:10:24.955761296Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"UBUNTU-CVE-2024-29018","description":"Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well. When containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs. Containers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly. In addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver. When a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container's network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself. As a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved. Many systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host's configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected. Because `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers. Docker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address. Moby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container's network namespace.","status":"published","published":"2024-03-20T21:15:00Z","modified":"2026-02-04T03:24:53.991862Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"GO-2024-2659","title":"Data exfiltration from internal networks in github.com/docker/docker","description":"dockerd forwards DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics, networks marked as 'internal' can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.","status":"published","published":"2024-03-22T18:49:03Z","modified":"2026-02-04T03:49:59.997291Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"MGASA-2025-0189","title":"Updated docker packages fix security vulnerability","description":"External DNS requests from 'internal' networks could lead to data\nexfiltration - CVE-2024-29018\nWe can't determine if docker 24.0.5 is affected but as it is no longer\nsupported we are releasing version 25.0.7, as it is supported and free of\nthe CVE.\n","status":"published","published":"2025-06-24T20:11:57Z","modified":"2026-04-16T04:41:51.966755051Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2024:14597-1","title":"docker-27.4.1_ce-12.1 on GA media","description":"These are all security issues fixed in the docker-27.4.1_ce-12.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-18T00:00:00Z","modified":"2026-02-04T03:42:40.24124Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14598-1","title":"docker-stable-24.0.9_ce-6.1 on GA media","description":"These are all security issues fixed in the docker-stable-24.0.9_ce-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-18T00:00:00Z","modified":"2026-02-04T03:33:42.928491Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2025:0226-1","title":"Security update for docker-stable","description":"This update for docker-stable fixes the following issues:\n\n- CVE-2024-29018: Fixed external DNS request handling from 'internal' networks that could have led to data exfiltration (bsc#1234089).\n- CVE-2024-23650: Fixed possibile BuildKit daemon crash via malicious BuildKit client or frontend request (bsc#1219437).\n","status":"published","published":"2025-01-27T07:26:16Z","modified":"2026-02-04T03:20:21.295383Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:03540-1","title":"Security update for docker-stable","description":"This update for docker-stable fixes the following issues:\n\n- Include historical changelog data from before the docker-stable fork. The\n  initial changelog entry did technically provide all the necessary\n  information, but our CVE tracking tools do not understand how the package is\n  forked and so it seems that this package does not include fixes for ~12 years\n  of updates. So, include a copy of the original package's changelog up until\n  the fork point. (bsc#1250596)\n\n- Remove git-core recommends on SLE. Most SLE systems have\n  installRecommends=yes by default and thus end up installing git with Docker.\n  bsc#1250508\n\n  This feature is mostly intended for developers ('docker build git://') so\n  most users already have the dependency installed, and the error when git is\n  missing is fairly straightforward (so they can easily figure out what they\n  need to install).\n\n- Backport \u003chttps://github.com/moby/moby/pull/48517\u003e. bsc#1247362\n\n- Update to docker-buildx v0.25.0. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.25.0\u003e\n\n- Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as\n  Docker does not have permission to access the host zypper credentials in this\n  mode (and unprivileged users cannot disable the feature using\n  /etc/docker/suse-secrets-enable.) bsc#1240150\n\n- Initial docker-stable fork, forked from Docker 24.0.7-ce release\n  (packaged on 2024-02-14). The original changelog is included below for\n  historical reference.\n","status":"published","published":"2025-10-10T19:04:02Z","modified":"2026-02-04T02:38:37.010407Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:03545-1","title":"Security update for docker-stable","description":"This update for docker-stable fixes the following issues:\n\nNote this update contains a already fixed references mostly.\n\n- Remove git-core recommends on SLE to avoid pulling it in unnecessary. (bsc#1250508)\n\n  This feature is mostly intended for developers ('docker build git://') so\n  most users already have the dependency installed, and the error when git is\n  missing is fairly straightforward (so they can easily figure out what they\n  need to install).\n\n- Include historical changelog data from before the docker-stable fork. The\n  initial changelog entry did technically provide all the necessary\n  information, but our CVE tracking tools do not understand how the package is\n  forked and so it seems that this package does not include fixes for ~12 years\n  of updates. So, include a copy of the original package's changelog up until\n  the fork point. bsc#1250596\n\n- Update to docker-buildx v0.25.0. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.25.0\u003e\n\n- Update to Go 1.23 for building now that upstream has switched their 23.0.x\n  LTSS to use Go 1.23.\n\n- Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as\n  Docker does not have permission to access the host zypper credentials in this\n  mode (and unprivileged users cannot disable the feature using\n  /etc/docker/suse-secrets-enable.) bsc#1240150\n\n- Initial docker-stable fork, forked from Docker 24.0.7-ce release\n  (packaged on 2024-02-14). The original changelog is included below for\n  historical reference.\n","status":"published","published":"2025-10-11T01:20:50Z","modified":"2026-03-23T04:48:05.17767Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0776-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\nUpdate to Docker 27.5.1-ce (bsc#1237335):\n\n- CVE-2024-29018: External DNS requests from 'internal' networks could lead to data exfiltration (bsc#1234089).\n","status":"published","published":"2025-03-04T14:55:49Z","modified":"2026-02-04T02:54:25.599237Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0992-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\nUpdate to Docker 27.5.1-ce (bsc#1237335):\n\n- CVE-2024-29018: External DNS requests from 'internal' networks could lead to data exfiltration (bsc#1234089).\n","status":"published","published":"2025-03-24T14:31:39Z","modified":"2026-02-04T02:50:48.326239Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:1062-1","title":"Security update for docker, docker-stable","description":"This update for docker, docker-stable fixes the following issues:\n\n\n- CVE-2025-22868: Fixed unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239185).\n- CVE-2025-22869: Fixed Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).\n\nOther fixes:\n- Make container-selinux requirement conditional on selinux-policy (bsc#1237367)\n","status":"published","published":"2025-03-31T08:45:25Z","modified":"2026-02-04T02:54:10.914407Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:1102-1","title":"Security update for docker, docker-stable","description":"This update for docker, docker-stable fixes the following issues:\n\n- CVE-2025-22868: Fixed unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239185).\n- CVE-2025-22869: Fixed Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).\n- CVE-2024-29018: Fixed external DNS requests from 'internal' networks leading to data exfiltration (bsc#1234089).\n- CVE-2024-23650: Fixed BuildKit daemon crash via malicious BuildKit client or frontend request (bsc#1219437).\n\nOther fixes:\n- Make container-selinux requirement conditional on selinux-policy (bsc#1237367).\n- Updated docker-buildx to 0.19.3.\n","status":"published","published":"2025-04-02T09:39:33Z","modified":"2026-02-04T03:17:16.530364Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20205-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\n- Updated to docker-buildx v0.22.0.\n- Updated to Docker 27.5.1-ce.\n- CVE-2025-0495: buildx: Fixed credential leakage to telemetry endpoints (bsc#1239765)\n- CVE-2025-22868: Fixed golang.org/x/oauth2/jws: Unexpected memory\n  consumption during token parsing in golang.org/x/oauth2 (bsc#1239185)\n- CVE-2025-22869: Fixed golang.org/x/crypto/ssh: Denial of Service in\n  the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).\n- CVE-2024-29018:moby: external DNS requests from 'internal' networks could lead to data exfiltration (bsc#1234089)\n- Make container-selinux requirement conditional on selinux-policy (bsc#1237367)\n","status":"published","published":"2025-04-24T14:50:44Z","modified":"2026-03-23T04:50:43.722308Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20259-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\n- This update includes fixes for:\n\n  * CVE-2024-41110: Fixed Authz zero length regression (bsc#1228324)\n  * CVE-2023-47108: Fixed otelgrpc: DoS vulnerability in otelgrpc\n    (uncontrolled resource consumption) due to unbound cardinality\n    (bsc#1217070 bsc#1229806)\n  * CVE-2023-45142: Fixed otelhttp,otelhttptrace,otelrestful: DoS\n    vulnerability (bsc#1228553 bsc#1229806)\n\n- Update to Docker 27.5.1-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/27/#2741\u003e bsc#1237335\n\n- Update to docker-buildx 0.20.1. See upstream changelog online at\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.20.1\u003e\n\n- Update to Docker 27.4.1-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/27/#2741\u003e\n\n- Update to docker-buildx 0.19.3. See upstream changelog online at\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.19.3\u003e\n\n- Update to Docker 27.4.0-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/27/#274\u003e\n\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.19.2\u003e.\n\n  Some notable changelogs from the last update:\n    * \u003chttps://github.com/docker/buildx/releases/tag/v0.19.0\u003e\n    * \u003chttps://github.com/docker/buildx/releases/tag/v0.18.0\u003e\n\n- Update to Go 1.22.\n\n- Add a new toggle file /etc/docker/suse-secrets-enable which allows users to\n  disable the SUSEConnect integration with Docker (which creates special mounts\n  in /run/secrets to allow container-suseconnect to authenticate containers\n  with registries on registered hosts). bsc#1231348 bsc#1232999\n\n  In order to disable these mounts, just do\n\n    echo 0 \u003e /etc/docker/suse-secrets-enable\n\n  and restart Docker. In order to re-enable them, just do\n\n    echo 1 \u003e /etc/docker/suse-secrets-enable\n\n  and restart Docker. Docker will output information on startup to tell you\n  whether the SUSE secrets feature is enabled or not.\n\n- Disable docker-buildx builds for SLES. It turns out that build containers\n  with docker-buildx don't currently get the SUSE secrets mounts applied,\n  meaning that container-suseconnect doesn't work when building images.\n  bsc#1233819\n\n- Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from\n  sysconfig a long time ago, and apparently this causes issues with systemd in\n  some cases.\n\n- Update to docker-buildx v0.17.1 to match standalone docker-buildx package we\n  are replacing. See upstream changelog online at\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.17.1\u003e\n\n- Mark docker-buildx as required since classic \"docker build\" has been\n  deprecated since Docker 23.0. bsc#1230331\n\n- Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate\n  package, but with docker-stable it will be necessary to maintain the packages\n  together and it makes more sense to have them live in the same OBS package.\n  bsc#1230333\n\n- Update to Docker 26.1.5-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/26.1/#2615\u003e\n  bsc#1230294\n\n","status":"published","published":"2025-03-31T16:54:17Z","modified":"2026-03-23T04:50:06.243016Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2026:0972-1","title":"Security update for docker-stable","description":"This update for docker-stable fixes the following issues:\n\n- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption\n  (bsc#1253904).\n","status":"published","published":"2026-03-23T15:21:42Z","modified":"2026-03-24T08:45:06.794921Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1118-1","title":"Security update for docker-stable","description":"This update for docker-stable fixes the following issues:\n\n- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption\n  (bsc#1253904).\n","status":"published","published":"2026-03-27T12:26:18Z","modified":"2026-03-29T10:45:24.83268Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"USN-7161-1","title":"Docker vulnerabilities","description":"Yair Zak discovered that Docker could unexpectedly forward DNS requests\nfrom internal networks in an unexpected manner. An attacker could possibly\nuse this issue to exfiltrate data by encoding information in DNS queries \nto controlled nameservers. This issue was only addressed for the source package\ndocker.io-app in Ubuntu 24.04 LTS. (CVE-2024-29018)\n\nCory Snider discovered that Docker did not properly handle authorization \nplugin request processing. An attacker could possibly use this issue to \nbypass authorization controls by forwarding API requests without their \nfull body, leading to unauthorized actions. This issue was only addressed for \nthe source package docker.io-app in Ubuntu 24.10 and Ubuntu 24.04 LTS, \nand the source package docker.io in Ubuntu 18.04 LTS. (CVE-2024-41110)\n","status":"published","published":"2024-12-16T13:56:40Z","modified":"2026-04-27T17:38:01.152068Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7161-2","title":"Docker vulnerabilities","description":"USN-7161-1 fixed CVE-2024-29018 in Ubuntu 24.04 LTS. This update fixes it\n for source package docker.io in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and source\n package docker.io-app for Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.\n\n USN-7161-1 fixed CVE-2024-41110 in Ubuntu 24.10, Ubuntu 24.04 LTS, and \nUbuntu 18.04 LTS. This update fixes it for source package docker.io-app in\n Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.\n\nOriginal advisory details:\n\n Yair Zak discovered that Docker could unexpectedly forward DNS requests\nfrom internal networks in an unexpected manner. An attacker could possibly\nuse this issue to exfiltrate data by encoding information in DNS queries \nto controlled nameservers. This issue was only addressed for the source package\ndocker.io-app in Ubuntu 24.04 LTS. (CVE-2024-29018)\n\nCory Snider discovered that Docker did not properly handle authorization \nplugin request processing. An attacker could possibly use this issue to \nbypass authorization controls by forwarding API requests without their \nfull body, leading to unauthorized actions. This issue was only addressed for \nthe source package docker.io-app in Ubuntu 24.10 and Ubuntu 24.04 LTS, \nand the source package docker.io in Ubuntu 18.04 LTS. (CVE-2024-41110)\n","status":"published","published":"2025-02-18T08:22:46Z","modified":"2026-06-25T13:32:29.861684665Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}