{"id":"CVE-2025-54388","aliases":["ALPINE-CVE-2025-54388","BELL-CVE-2025-54388","EUVD-2025-23167","GHSA-x4rx-4gw3-53p4","GO-2025-3830","SUSE-SU-2025:02912-1","SUSE-SU-2025:02913-1","SUSE-SU-2025:02914-1","SUSE-SU-2025:20565-1","SUSE-SU-2025:20743-1","SUSE-SU-2026:20095-1","SUSE-SU-2026:20112-1","UBUNTU-CVE-2025-54388","openSUSE-SU-2025:15395-1","openSUSE-SU-2025:15434-1","openSUSE-SU-2026:20057-1"],"status":"published","title":"Moby's Firewalld reload makes published container ports accessible from remote hosts","description":"Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00265,"percentile":0.18625,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-909"],"published":"2025-07-29T19:56:22Z","modified":"2026-11-03T06:33:00Z","fixes":[{"ecosystem":"Go","package":"github.com/docker/docker","fixed_in":["28.3.3","28.3.3+incompatible"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.22","package":"docker","fixed_in":["28.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"docker","fixed_in":["28.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"docker","fixed_in":["28.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"docker","fixed_in":["28.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"docker","fixed_in":["28.3.3-r0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"docker","fixed_in":["28.3.3_ce-98.137.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"docker","fixed_in":["28.3.3_ce-98.137.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"docker","fixed_in":["28.3.3_ce-150000.230.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"docker","fixed_in":["28.3.3_ce-6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"docker","fixed_in":["28.4.0_ce-slfo.1.1_6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"docker","fixed_in":["28.5.1_ce-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"docker","fixed_in":["28.5.1_ce-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"docker","fixed_in":["28.5.1_ce-160000.4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"docker","fixed_in":["28.3.3_ce-26.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"docker","fixed_in":["28.5.1_ce-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/docker/docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.2.0"},{"fixed":"28.3.3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.2.1-r0"},{"fixed":"28.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.2.1-r0"},{"fixed":"28.3.3-r0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/docker/docker","ranges":[{"type":"SEMVER","events":[{"introduced":"28.2.0"},{"fixed":"28.3.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/docker/docker","ranges":[{"type":"SEMVER","events":[{"introduced":"28.2.0+incompatible"},{"fixed":"28.3.3+incompatible"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250814T182633-150000.1.98.1"}]}],"bundled":31},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250814T182633-150000.1.98.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-98.137.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-98.137.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-150000.230.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.4.0_ce-slfo.1.1_6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-160000.4.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.2~dfsg1-1ubuntu4","1.10.2-0ubuntu3","1.10.2-0ubuntu4","1.10.3-0ubuntu1","1.10.3-0ubuntu4","1.10.3-0ubuntu5","1.10.3-0ubuntu6","1.11.2-0ubuntu5~16.04","1.12.1-0ubuntu13~16.04.1","1.12.3-0ubuntu4~16.04.2","1.12.6-0ubuntu1~16.04.1","1.13.1-0ubuntu1~16.04.2","17.03.2-0ubuntu2~16.04.1","18.06.1-0ubuntu1~16.04.2","18.06.1-0ubuntu1.2~16.04.1","18.09.2-0ubuntu1~16.04.1","18.09.5-0ubuntu1~16.04.2","18.09.7-0ubuntu1~16.04.1","18.09.7-0ubuntu1~16.04.4","18.09.7-0ubuntu1~16.04.5","18.09.7-0ubuntu1~16.04.6","18.09.7-0ubuntu1~16.04.7","18.09.7-0ubuntu1~16.04.9+esm1","18.09.7-0ubuntu1~16.04.9+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.1-0ubuntu6","17.03.2-0ubuntu1","17.03.2-0ubuntu3","17.03.2-0ubuntu5","17.12.1-0ubuntu1","18.06.1-0ubuntu1~18.04.1","18.06.1-0ubuntu1.2~18.04.1","18.09.2-0ubuntu1~18.04.1","18.09.5-0ubuntu1~18.04.2","18.09.7-0ubuntu1~18.04.1","18.09.7-0ubuntu1~18.04.3","18.09.7-0ubuntu1~18.04.4","19.03.6-0ubuntu1~18.04.1","19.03.6-0ubuntu1~18.04.2","19.03.6-0ubuntu1~18.04.3","20.10.2-0ubuntu1~18.04.2","20.10.2-0ubuntu1~18.04.3","20.10.7-0ubuntu1~18.04.1","20.10.7-0ubuntu1~18.04.2","20.10.7-0ubuntu5~18.04.2","20.10.7-0ubuntu5~18.04.3","20.10.12-0ubuntu2~18.04.1","20.10.21-0ubuntu1~18.04.2","20.10.21-0ubuntu1~18.04.3","20.10.21-0ubuntu1~18.04.3+esm1","20.10.21-0ubuntu1~18.04.3+esm2","20.10.21-0ubuntu1~18.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["19.03.2-0ubuntu1","19.03.6-0ubuntu1","19.03.8-0ubuntu1","19.03.8-0ubuntu1.20.04","19.03.8-0ubuntu1.20.04.1","19.03.8-0ubuntu1.20.04.2","20.10.2-0ubuntu1~20.04.2","20.10.2-0ubuntu1~20.04.3","20.10.7-0ubuntu1~20.04.1","20.10.7-0ubuntu1~20.04.2","20.10.7-0ubuntu5~20.04.1","20.10.7-0ubuntu5~20.04.2","20.10.12-0ubuntu2~20.04.1","20.10.21-0ubuntu1~20.04.1","20.10.21-0ubuntu1~20.04.2","20.10.21-0ubuntu1~20.04.4","20.10.21-0ubuntu1~20.04.5","20.10.21-0ubuntu1~20.04.6","20.10.21-0ubuntu1~20.04.6+esm1","20.10.21-0ubuntu1~20.04.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.10.7-0ubuntu5","20.10.7-0ubuntu7","20.10.12-0ubuntu1","20.10.12-0ubuntu2","20.10.12-0ubuntu3","20.10.12-0ubuntu3+gke1.24.1","20.10.12-0ubuntu4","20.10.21-0ubuntu1~22.04.2","20.10.21-0ubuntu1~22.04.3","20.10.21-0ubuntu1~22.04.5","20.10.21-0ubuntu1~22.04.6","20.10.21-0ubuntu1~22.04.7","20.10.21-0ubuntu1~22.04.7+esm1","20.10.21-0ubuntu1~22.04.7+esm2","20.10.21-0ubuntu1~22.04.8","20.10.21-0ubuntu1~22.04.8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"docker.io-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.10.25-0ubuntu1~22.04.1","20.10.25-0ubuntu1~22.04.2","24.0.5-0ubuntu1~22.04.1","24.0.7-0ubuntu2~22.04.1","26.1.3-0ubuntu1~22.04.1","26.1.3-0ubuntu1~22.04.1+esm1","27.5.1-0ubuntu3~22.04.1","27.5.1-0ubuntu3~22.04.2","28.2.2-0ubuntu1~22.04.1","29.1.3-0ubuntu3~22.04.1","29.1.3-0ubuntu3~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.10.24+dfsg1-1ubuntu2","20.10.25+dfsg1-2ubuntu1","20.10.25+dfsg1-2ubuntu1+esm1","20.10.25+dfsg1-2ubuntu1+esm2","20.10.25+dfsg1-2ubuntu1.24.04.1","20.10.25+dfsg1-2ubuntu1.24.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"docker.io-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["24.0.5-0ubuntu1","24.0.7-0ubuntu1","24.0.7-0ubuntu2","24.0.7-0ubuntu3","24.0.7-0ubuntu4","24.0.7-0ubuntu4.1","26.1.3-0ubuntu1~24.04.1","26.1.3-0ubuntu1~24.04.1+esm1","27.5.1-0ubuntu3~24.04.1","27.5.1-0ubuntu3~24.04.2","28.2.2-0ubuntu1~24.04.1","29.1.3-0ubuntu3~24.04.1","29.1.3-0ubuntu3~24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["26.1.5+dfsg1-9ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"docker.io-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["27.5.1-0ubuntu3","27.5.1-0ubuntu4","28.2.2-0ubuntu1","29.1.3-0ubuntu3~25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["27.5.1+dfsg4-2ubuntu1","28.5.2+dfsg4-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["26.1.5+dfsg1-9ubuntu1","27.5.1+dfsg4-1ubuntu1","27.5.1+dfsg4-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"docker.io-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["28.2.2-0ubuntu1","29.1.2-0ubuntu1","29.1.3-0ubuntu1","29.1.3-0ubuntu2","29.1.3-0ubuntu3","29.1.3-0ubuntu4","29.1.3-0ubuntu4.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.3.3_ce-26.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250811T192933-1.1"}]}],"bundled":29},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.1_ce-160000.4.1"}]}]}],"products":[{"vendor":"moby","product":"moby"},{"vendor":"mobyproject","product":"moby"}],"references":[{"url":"https://github.com/moby/moby/security/advisories/GHSA-x4rx-4gw3-53p4","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/moby/moby/pull/50506","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/moby/moby/commit/bea959c7b793b32a893820b97c4eadc7c87fabb0","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54388","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x4rx-4gw3-53p4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-54388","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-54388","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54388.json","tags":["advisory"]},{"url":"https://github.com/moby/moby","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502912-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-44779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-50738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8341","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502913-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246556","tags":["report"]},{"url":"https://bugzilla.suse.com/1247367","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502914-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520565-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520743-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1247594","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620095-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248373","tags":["report"]},{"url":"https://bugzilla.suse.com/1250508","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620112-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-54388","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-54388","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-54388","title":"Moby's Firewalld reload makes published container ports accessible from remote hosts","description":"Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.","status":"published","published":"2025-07-30T13:24:06.849Z","modified":"2025-07-30T13:38:07.559Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-909"],"updated_at":"2026-11-02T14:32:27.28543Z"}],"euvd":[{"id":"EUVD-2025-23167","description":"Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.","status":"published","published":"2025-07-30T13:24:06Z","modified":"2025-07-30T13:38:07Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:32:02.888981Z"}],"ghsa":[{"id":"GHSA-x4rx-4gw3-53p4","title":"Moby firewalld reload makes published container ports accessible from remote hosts ","description":"Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (dockerd), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as Docker, or Docker Engine.\n\nFirewalld is a daemon used by some Linux distributions to provide a dynamically managed firewall. When Firewalld is running, Docker uses its iptables backend to create rules, including rules to isolate containers in one bridge network from containers in other bridge networks.\n\n### Impact\n\nThe iptables rules created by Docker are removed when firewalld is reloaded using, for example \"firewall-cmd --reload\", \"killall -HUP firewalld\", or \"systemctl reload firewalld\".\n\nWhen that happens, Docker must re-create the rules. However, in affected versions of Docker, the iptables rules that prevent packets arriving on a host interface from reaching container addresses are not re-created.\n\nOnce these rules have been removed, a remote host configured with a route to a Docker bridge network can access published ports, even when those ports were only published to a loopback address. Unpublished ports remain inaccessible.\n\nFor example, following a firewalld reload on a Docker host with address `192.168.0.10` and a bridge network with subnet `172.17.0.0/16`, running the following command on another host in the local network will give it access to published ports on container addresses in that network: `ip route add 172.17.0.0/16 via 192.168.0.10`.\n\nContainers running in networks created with `--internal` or equivalent have no access to other networks. Containers that are only connected to these networks remain isolated after a firewalld reload.\n\nWhere Docker Engine is not running in the host's network namespace, it is unaffected. Including, for example, Rootless Mode, and Docker Desktop.\n\n### Patches\n\nMoby releases older than 28.2.0 are not affected. A fix is available in moby release 28.3.3.\n\n### Workarounds\nAfter reloading firewalld, either:\n- Restart the docker daemon,\n- Re-create bridge networks, or\n- Use rootless mode.\n\n### References\nhttps://firewalld.org/\nhttps://firewalld.org/documentation/howto/reload-firewalld.html","status":"published","published":"2025-07-29T19:56:22Z","modified":"2025-09-10T21:02:11Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-909"],"updated_at":"2026-11-02T14:38:57.074217Z"}],"nvd":[{"id":"CVE-2025-54388","description":"Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.","status":"published","published":"2025-07-30T14:15:28.693Z","modified":"2026-06-17T09:40:00.063Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-909"],"updated_at":"2026-11-02T14:11:21.71471Z"}],"osv":[{"id":"ALPINE-CVE-2025-54388","description":"Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.","status":"published","published":"2025-07-30T14:15:28.693Z","modified":"2026-11-03T06:33:00.751756457Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"BELL-CVE-2025-54388","status":"published","published":"2025-07-30T10:10:16.907843Z","modified":"2026-01-26T09:40:32.763607Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-54388","title":"Moby's Firewalld reload makes published container ports accessible from remote hosts","description":"Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.","status":"published","published":"2025-07-30T13:24:06.849Z","modified":"2026-10-28T02:30:41.557770474Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-909"],"updated_at":"2026-11-02T15:44:50.863921Z"},{"id":"GHSA-x4rx-4gw3-53p4","title":"Moby firewalld reload makes published container ports accessible from remote hosts ","description":"Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (dockerd), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as Docker, or Docker Engine.\n\nFirewalld is a daemon used by some Linux distributions to provide a dynamically managed firewall. When Firewalld is running, Docker uses its iptables backend to create rules, including rules to isolate containers in one bridge network from containers in other bridge networks.\n\n### Impact\n\nThe iptables rules created by Docker are removed when firewalld is reloaded using, for example \"firewall-cmd --reload\", \"killall -HUP firewalld\", or \"systemctl reload firewalld\".\n\nWhen that happens, Docker must re-create the rules. However, in affected versions of Docker, the iptables rules that prevent packets arriving on a host interface from reaching container addresses are not re-created.\n\nOnce these rules have been removed, a remote host configured with a route to a Docker bridge network can access published ports, even when those ports were only published to a loopback address. Unpublished ports remain inaccessible.\n\nFor example, following a firewalld reload on a Docker host with address `192.168.0.10` and a bridge network with subnet `172.17.0.0/16`, running the following command on another host in the local network will give it access to published ports on container addresses in that network: `ip route add 172.17.0.0/16 via 192.168.0.10`.\n\nContainers running in networks created with `--internal` or equivalent have no access to other networks. Containers that are only connected to these networks remain isolated after a firewalld reload.\n\nWhere Docker Engine is not running in the host's network namespace, it is unaffected. Including, for example, Rootless Mode, and Docker Desktop.\n\n### Patches\n\nMoby releases older than 28.2.0 are not affected. A fix is available in moby release 28.3.3.\n\n### Workarounds\nAfter reloading firewalld, either:\n- Restart the docker daemon,\n- Re-create bridge networks, or\n- Use rootless mode.\n\n### References\nhttps://firewalld.org/\nhttps://firewalld.org/documentation/howto/reload-firewalld.html","status":"published","published":"2025-07-29T19:56:22Z","modified":"2026-09-10T03:50:26.417777166Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-909"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"UBUNTU-CVE-2025-54388","description":"Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.","status":"published","published":"2025-07-30T14:15:00Z","modified":"2026-10-17T12:58:36.811252377Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"GO-2025-3830","title":"Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker","description":"Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker","status":"published","published":"2025-08-11T17:24:51Z","modified":"2026-02-04T02:29:53.346273Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15395-1","title":"docker-28.3.3_ce-26.1 on GA media","description":"These are all security issues fixed in the docker-28.3.3_ce-26.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-30T00:00:00Z","modified":"2026-03-23T04:53:44.059735Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15434-1","title":"govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250811T192933-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-12T00:00:00Z","modified":"2026-03-23T04:53:46.634804Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:20057-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\nChanges in docker:\n\n- Update to Docker 28.5.1-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/28/#2851\u003e\n\n- Update to Docker 28.5.0-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/28/#2850\u003e\n\n- Update to docker-buildx v0.29.0. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.29.0\u003e\n\n- Remove git-core recommends on SLE. Most SLE systems have\n  installRecommends=yes by default and thus end up installing git with Docker.\n  bsc#1250508\n\n  This feature is mostly intended for developers (\"docker build git://\") so\n  most users already have the dependency installed, and the error when git is\n  missing is fairly straightforward (so they can easily figure out what they\n  need to install).\n\n- Update to docker-buildx v0.28.0. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.28.0\u003e\n\n- Update to Docker 28.4.0-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/28/#2840\u003e\n  * Fixes a nil pointer panic in \"docker push\". bsc#1248373\n\n- Update warnings and errors related to \"docker buildx ...\" so that they\n  reference our openSUSE docker-buildx packages.\n\n- Enable building docker-buildx for SLE15 systems with SUSEConnect secret\n  injection enabled. PED-12534 PED-8905 bsc#1247594\n\n  As docker-buildx does not support our SUSEConnect secret injection (and some\n  users depend \"docker build\" working transparently), patch the docker CLI so\n  that \"docker build\" will no longer automatically call \"docker buildx build\",\n  effectively making DOCKER_BUILDKIT=0 the default configuration. Users can\n  manually use \"docker buildx ...\" commands or set DOCKER_BUILDKIT=1 in order\n  to opt-in to using docker-buildx.\n\n  Users can silence the \"docker build\" warning by setting DOCKER_BUILDKIT=0\n  explicitly.\n\n  In order to inject SCC credentials with docker-buildx, users should use\n\n    RUN --mount=type=secret,id=SCCcredentials zypper -n ...\n\n  in their Dockerfiles, and\n\n    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .\n\n  when doing their builds.\n\n- Update to Docker 28.3.3-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/28/#2833\u003e\n  CVE-2025-54388 bsc#1247367\n\n- Update to docker-buildx v0.26.1. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.26.1\u003e\n\n- Update to docker-buildx v0.26.0. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.26.0\u003e\n","status":"published","published":"2026-01-17T13:20:26Z","modified":"2026-03-23T04:54:42.836405Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2025:02912-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20250814T182633 2025-08-14T18:26:33Z (jsc#PED-11136)\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3765 CVE-2024-44906 GHSA-h4h6-vccr-44h2\n  * GO-2025-3829 CVE-2025-54410 GHSA-4vq8-7jfc-9cvp\n\n- Update to version 0.0.20250811T192933 2025-08-11T19:29:33Z (jsc#PED-11136)\n  \n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3822 CVE-2025-53942 GHSA-9g4j-v8w5-7x42\n  * GO-2025-3829 CVE-2025-54410 GHSA-4vq8-7jfc-9cvp\n  * GO-2025-3830 CVE-2025-54388 GHSA-x4rx-4gw3-53p4\n  * GO-2025-3831 CVE-2025-50738 GHSA-hfcf-79gh-f3jc\n  * GO-2025-3832 CVE-2021-21411 GHSA-652x-m2gr-hppm\n  * GO-2025-3833 CVE-2025-54576 GHSA-7rh7-c77v-6434\n  * GO-2025-3834 CVE-2025-54424 GHSA-8j63-96wh-wh3j\n  * GO-2025-3835 CVE-2025-54386 GHSA-q6gg-9f92-r9wg\n  * GO-2025-3836 CVE-2025-6037 GHSA-6c5r-4wfc-3mcx\n  * GO-2025-3837 CVE-2025-5999 GHSA-6h4p-m86h-hhgh\n  * GO-2025-3838 CVE-2025-6000 GHSA-mr4h-qf9j-f665\n  * GO-2025-3839 CVE-2025-6011 GHSA-mwgr-84fv-3jh9\n  * GO-2025-3840 CVE-2025-6004 GHSA-qgj7-fmq2-6cc4\n  * GO-2025-3841 CVE-2025-6014 GHSA-qv3p-fmv3-9hww\n  * GO-2025-3842 CVE-2025-6015 GHSA-v6r4-35f9-9rpw\n  * GO-2025-3843 CVE-2025-8341 GHSA-3c93-92r7-j934\n  * GO-2025-3844 CVE-2025-53534 GHSA-fm3m-jrgm-5ppg\n  * GO-2025-3845 CVE-2025-54801 GHSA-qx2q-88mx-vhg7\n  * GO-2025-3847 CVE-2025-54799 GHSA-q82r-2j7m-9rv4\n  * GO-2025-3848 CVE-2025-6013 GHSA-7rx2-769v-hrwf\n  * GO-2025-3851 CVE-2025-44779 GHSA-93jv-pvg8-hf3v\n  * GO-2025-3852 CVE-2025-7195 GHSA-856v-8qm2-9wjv\n  * GO-2025-3853 CVE-2025-55000 GHSA-f7c3-mhj2-9pvg\n  * GO-2025-3854 CVE-2025-54999 GHSA-hh28-h22f-8357\n  * GO-2025-3855 CVE-2025-54998 GHSA-j3xv-7fxp-gfhx\n  * GO-2025-3856 CVE-2025-55003 GHSA-rxp7-9q75-vj3p\n  * GO-2025-3857 CVE-2025-54996 GHSA-vf84-mxrq-crqc\n  * GO-2025-3858 CVE-2025-54997 GHSA-xp75-r577-cvhp\n  * GO-2025-3859 CVE-2025-55001 GHSA-2q8q-8fgw-9p6p\n\n- Update to version 0.0.20250807T150727 2025-08-07T15:07:27Z (jsc#PED-11136)\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3849 CVE-2025-47907\n","status":"published","published":"2025-08-19T12:52:27Z","modified":"2026-03-23T04:49:48.54789Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02913-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\n- Update to Docker 28.3.3-ce.\n- CVE-2025-54388: Fixed a bug where firewalld when reloaded can make published container ports accessible from remote hosts. (bsc#1247367)\n  ","status":"published","published":"2025-08-19T12:52:43Z","modified":"2026-03-23T04:46:53.436191Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02914-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\n- Update to Docker 28.3.3-ce.\n- CVE-2025-54388: Fixed a bug where firewalld when reloaded can make published container ports accessible from remote hosts. (bsc#1247367)\n  ","status":"published","published":"2025-08-19T12:54:57Z","modified":"2026-03-23T04:49:48.904506Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:20565-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\n- Update to Docker 28.3.3-ce: \n  * CVE-2025-54388: firewalld reload can make published container \n    ports accessible from remote hosts (bsc#1247367)\n\n- Update to docker-buildx v0.26.1.\n","status":"published","published":"2025-08-21T08:01:27Z","modified":"2026-03-23T04:50:11.676186Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20743-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\nUpdate to docker-buildx v0.28.0.\n\nSee upstream changelog: \u003chttps://github.com/docker/buildx/releases/tag/v0.28.0\u003e\n\nUpdate to Docker 28.4.0-ce.\n\nSee upstream changelog: \u003chttps://docs.docker.com/engine/release-notes/28/#2840\u003e\n\n- Update warnings and errors related to \"docker buildx ...\" so that they\n  reference our openSUSE docker-buildx packages.\n\n- Enable building docker-buildx for SLE15 systems with SUSEConnect secret\n  injection enabled.jsc#PED-12534jsc#PED-8905 bsc#1247594\n\n  As docker-buildx does not support our SUSEConnect secret injection (and some\n  users depend \"docker build\" working transparently), patch the docker CLI so\n  that \"docker build\" will no longer automatically call \"docker buildx build\",\n  effectively making DOCKER_BUILDKIT=0 the default configuration. Users can\n  manually use \"docker buildx ...\" commands or set DOCKER_BUILDKIT=1 in order\n  to opt-in to using docker-buildx.\n\n  Users can silence the \"docker build\" warning by setting DOCKER_BUILDKIT=0\n  explicitly.\n\n  In order to inject SCC credentials with docker-buildx, users should use\n\n    RUN --mount=type=secret,id=SCCcredentials zypper -n ...\n\n  in their Dockerfiles, and\n\n    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .\n\n  when doing their builds.\n\nUpdate to Docker 28.3.3-ce. See upstream changelog online at \u003chttps://docs.docker.com/engine/release-notes/28/#2833\u003e\n\nSecurity issue fixed:\n\n- CVE-2025-54388: firewalld reload can make published container ports accessible from remote hosts (bsc#1247367)\n\nUpdate to docker-buildx v0.26.1. Upstream changelog: \u003chttps://github.com/docker/buildx/releases/tag/v0.26.1\u003e\n\nUpdate to docker-buildx v0.26.0. Upstream changelog: \u003chttps://github.com/docker/buildx/releases/tag/v0.26.0\u003e\n\n","status":"published","published":"2025-09-10T16:09:16Z","modified":"2026-03-23T04:49:03.271843Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2026:20095-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\nChanges in docker:\n\n- Update to Docker 28.5.1-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/28/#2851\u003e\n\n- Update to Docker 28.5.0-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/28/#2850\u003e\n\n- Update to docker-buildx v0.29.0. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.29.0\u003e\n\n- Remove git-core recommends on SLE. Most SLE systems have\n  installRecommends=yes by default and thus end up installing git with Docker.\n  bsc#1250508\n\n  This feature is mostly intended for developers (\"docker build git://\") so\n  most users already have the dependency installed, and the error when git is\n  missing is fairly straightforward (so they can easily figure out what they\n  need to install).\n\n- Update to docker-buildx v0.28.0. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.28.0\u003e\n\n- Update to Docker 28.4.0-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/28/#2840\u003e\n  * Fixes a nil pointer panic in \"docker push\". bsc#1248373\n\n- Update warnings and errors related to \"docker buildx ...\" so that they\n  reference our openSUSE docker-buildx packages.\n\n- Enable building docker-buildx for SLE15 systems with SUSEConnect secret\n  injection enabled. PED-12534 PED-8905 bsc#1247594\n\n  As docker-buildx does not support our SUSEConnect secret injection (and some\n  users depend \"docker build\" working transparently), patch the docker CLI so\n  that \"docker build\" will no longer automatically call \"docker buildx build\",\n  effectively making DOCKER_BUILDKIT=0 the default configuration. Users can\n  manually use \"docker buildx ...\" commands or set DOCKER_BUILDKIT=1 in order\n  to opt-in to using docker-buildx.\n\n  Users can silence the \"docker build\" warning by setting DOCKER_BUILDKIT=0\n  explicitly.\n\n  In order to inject SCC credentials with docker-buildx, users should use\n\n    RUN --mount=type=secret,id=SCCcredentials zypper -n ...\n\n  in their Dockerfiles, and\n\n    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .\n\n  when doing their builds.\n\n- Update to Docker 28.3.3-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/28/#2833\u003e\n  CVE-2025-54388 bsc#1247367\n\n- Update to docker-buildx v0.26.1. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.26.1\u003e\n\n- Update to docker-buildx v0.26.0. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.26.0\u003e\n","status":"published","published":"2026-01-17T13:20:31Z","modified":"2026-03-23T04:52:35.559999Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20112-1","title":"Security update for docker","description":"This update for docker fixes the following issues:\n\nChanges in docker:\n\n- Update to Docker 28.5.1-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/28/#2851\u003e\n\n- Update to Docker 28.5.0-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/28/#2850\u003e\n\n- Update to docker-buildx v0.29.0. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.29.0\u003e\n\n- Remove git-core recommends on SLE. Most SLE systems have\n  installRecommends=yes by default and thus end up installing git with Docker.\n  bsc#1250508\n\n  This feature is mostly intended for developers (\"docker build git://\") so\n  most users already have the dependency installed, and the error when git is\n  missing is fairly straightforward (so they can easily figure out what they\n  need to install).\n\n- Update to docker-buildx v0.28.0. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.28.0\u003e\n\n- Update to Docker 28.4.0-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/28/#2840\u003e\n  * Fixes a nil pointer panic in \"docker push\". bsc#1248373\n\n- Update warnings and errors related to \"docker buildx ...\" so that they\n  reference our openSUSE docker-buildx packages.\n\n- Enable building docker-buildx for SLE15 systems with SUSEConnect secret\n  injection enabled. PED-12534 PED-8905 bsc#1247594\n\n  As docker-buildx does not support our SUSEConnect secret injection (and some\n  users depend \"docker build\" working transparently), patch the docker CLI so\n  that \"docker build\" will no longer automatically call \"docker buildx build\",\n  effectively making DOCKER_BUILDKIT=0 the default configuration. Users can\n  manually use \"docker buildx ...\" commands or set DOCKER_BUILDKIT=1 in order\n  to opt-in to using docker-buildx.\n\n  Users can silence the \"docker build\" warning by setting DOCKER_BUILDKIT=0\n  explicitly.\n\n  In order to inject SCC credentials with docker-buildx, users should use\n\n    RUN --mount=type=secret,id=SCCcredentials zypper -n ...\n\n  in their Dockerfiles, and\n\n    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .\n\n  when doing their builds.\n\n- Update to Docker 28.3.3-ce. See upstream changelog online at\n  \u003chttps://docs.docker.com/engine/release-notes/28/#2833\u003e\n  CVE-2025-54388 bsc#1247367\n\n- Update to docker-buildx v0.26.1. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.26.1\u003e\n\n- Update to docker-buildx v0.26.0. Upstream changelog:\n  \u003chttps://github.com/docker/buildx/releases/tag/v0.26.0\u003e\n","status":"published","published":"2026-01-17T13:20:31Z","modified":"2026-03-23T04:47:20.529131Z","updated_at":"2026-11-02T15:54:01.610851Z"}]}}