Description
An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA (as opposed to one signed by the configured CA root certificate) to authenticate.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | docker.io | 18.03.1+dfsg1-2 | — |
| Debian 13 | docker.io | 18.03.1+dfsg1-2 | — |
| Debian 12 | docker.io | 18.03.1+dfsg1-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | docker.io | 18.06.1-0ubuntu1~18.04.1 | — |
| Ubuntu 16.04 LTS | docker.io | 18.06.1-0ubuntu1~16.04.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/docker/docker | < 17.06.0-ce | 17.06.0-ce | GHSA-qrqr-3x5j-2xw9 |