Skip to content
OpenAdvisories
Low USN-5103-1 1 CVE

docker.io vulnerability

Published Oct 4, 2021 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Lei Wang and Ruizhi Xiao discovered that the Moby Docker engine in
Docker incorrectly allowed the docker cp command to make permissions
changes in the host filesystem in some situations. A local attacker
could possibly use to this to expose sensitive information or gain
administrative privileges.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS docker.io 20.10.7-0ubuntu1~18.04.2
Ubuntu · 20.04 LTS 20.04:LTS docker.io 20.10.7-0ubuntu1~20.04.2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS docker.io 18.09.7-0ubuntu1~16.04.9+esm1

Vulnerabilities 1

  • Low 2.8
    CVE-2021-41089

    `docker cp` allows unexpected chmod of host files

    Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for ex…

    moby moby docker.io docker.io Debian Ubuntu Alpine Wolfi Go

References

  • report
    https://ubuntu.com/security/CVE-2021-41089