Skip to content
OpenAdvisories
Critical · 10.0 Public exploit CVE-2024-41110 EUVD-2024-2415GHSA-v23v-6jw2-98fqGO-2024-3005

Moby authz zero length regression

Published Jul 24, 2024 · Updated Oct 13, 2024 · Assigned by GitHub_M

Vendor: moby Product: moby Package: aactl Package: apko Package: argo-workflows Package: bom Package: buf Package: buildah Package: buildctl Package: buildkitd Package: cadvisor Package: cert-manager-cmctl Package: chartmuseum Package: cilium-cli Package: cosign Package: cri-tools Package: crictl Package: critest Package: crossplane-crank Package: ctop Package: dagdotdev Package: dagger Package: dive Package: docker Package: docker-compose Package: docker-credential-gcr Package: docker.io Package: docker.io Package: docker.io-app Package: eksctl Package: falcoctl Package: flux Package: flux-helm-controller Package: flux-helm-controller-iamguarded-compat Package: flux-image-reflector-controller Package: flux-image-reflector-controller-iamguarded-compat Package: flux-source-controller Package: flux-source-controller-iamguarded-compat Package: gh Package: gh-doc Package: github.com/docker/docker Package: github.com/moby/moby Package: gitsign Package: gitsign-config Package: gitsign-credential-cache Package: goreleaser Package: grafana-alloy Package: grype Package: guac Package: guaccsub Package: guacgql Package: guacingest Package: guacone Package: harbor-scanner-trivy Package: helm Package: helm-3 Package: helm-4 Package: helm-operator Package: helm-operator-compat Package: helm-push Package: k3d Package: k3d-proxy Package: k3d-tools Package: k3s Package: k3s-multicall Package: k3s-static Package: k8sgpt Package: k9s Package: kaniko Package: kargo Package: kargo-oci-compat Package: katib-controller Package: katib-controller-compat Package: katib-db-manager Package: katib-db-manager-compat Package: katib-earlystopping Package: katib-file-metricscollector Package: katib-file-metricscollector-compat Package: katib-suggestion-goptuna Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: ko Package: kots Package: kots-compat Package: kots-symlink-compat Package: kpt Package: kubeflow-katib Package: kubescape Package: melange Package: moby-engine Package: nerdctl Package: neuvector-scanner Package: neuvector-scanner-monitor Package: neuvector-scanner-task Package: neuvector-sigstore-interface Package: newrelic-infrastructure-agent Package: opentelemetry-collector Package: opentelemetry-collector-contrib Package: paranoia Package: policy-controller Package: policy-controller-tester Package: rancher-fleet Package: rancher-fleet-agent Package: rancher-fleet-cli Package: rancher-fleet-controller Package: rancher-fleet-termination-log Package: scorecard Package: skaffold Package: skopeo Package: slsa-verifier Package: syft Package: tekton-chains Package: timoni Package: tkn Package: trivy Package: up Package: vcluster Package: vcluster-cli Package: vcluster-syncer Package: vexctl Package: wolfictl Package: zarf Package: zot Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low.

Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.

A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.

Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.

docker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.

Affected products

VendorProductAffectedFixed
moby moby >= 19.03.0, <= 19.03.15, >= 20.0.0, <= 20.10.27, >= 23.0.0, <= 23.0.14, >= 24.0.0, <= 24.0.9, >= 25.0.0, <= 25.0.5, >= 26.0.0, <= 26.0.2, >= 26.1.0, <= 26.1.14, >= 27.0.0, <= 27.0.3, = 27.1.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 docker.io 26.1.5+dfsg1-2 —
Debian 13 docker.io 26.1.5+dfsg1-2 —
Debian 12 docker.io 20.10.24+dfsg1-1+deb12u1 —
Debian 11 docker.io 20.10.5+dfsg1-1+deb11u3 DLA-3918-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS docker.io-app 27.5.1-0ubuntu3~24.04.2 —
Ubuntu 22.04 LTS docker.io-app 27.5.1-0ubuntu3~22.04.2 —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS docker.io 20.10.25+dfsg1-2ubuntu1+esm1 USN-7161-3
Ubuntu Pro 24.04 LTS docker.io-app 26.1.3-0ubuntu1~24.04.1+esm1 USN-7161-1
Ubuntu Pro 22.04 LTS docker.io 20.10.21-0ubuntu1~22.04.7+esm1 USN-7161-3
Ubuntu Pro 22.04 LTS docker.io-app 26.1.3-0ubuntu1~22.04.1+esm1 USN-7161-2
Ubuntu Pro 20.04 LTS docker.io 20.10.21-0ubuntu1~20.04.6+esm1 USN-7161-3
Ubuntu Pro 20.04 LTS docker.io-app 26.1.3-0ubuntu1~20.04.1+esm1 USN-7161-2
Ubuntu Pro 18.04 LTS docker.io 20.10.21-0ubuntu1~18.04.3+esm1 USN-7161-2, USN-7161-1
Ubuntu Pro 16.04 LTS docker.io 18.09.7-0ubuntu1~16.04.9+esm2 USN-7161-2

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 docker-stable 24.0.9_ce-150000.1.25.1 SUSE-SU-2026:0972-1, SUSE-SU-2025:03545-1
SLES 15 SP6 apptainer 1.3.6-150600.4.9.1 SUSE-SU-2025:0980-1
SLES 15 SP6 docker 25.0.6_ce-150000.207.1 SUSE-SU-2025:1062-1, SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SLES 15 SP6 docker-stable 24.0.9_ce-150000.1.5.1 SUSE-SU-2025:1062-1, SUSE-SU-2025:03545-1, SUSE-SU-2025:0226-1
SLES 15 SP5 docker 25.0.6_ce-150000.207.1 SUSE-SU-2025:1062-1, SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SLES 15 SP5 docker-stable 24.0.9_ce-150000.1.5.1 SUSE-SU-2025:1062-1, SUSE-SU-2025:03545-1, SUSE-SU-2024:4204-1
SLES 15 SP4 docker 25.0.6_ce-150000.207.1 SUSE-SU-2025:1062-1, SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SLES 15 SP4 docker-stable 24.0.9_ce-150000.1.5.1 SUSE-SU-2025:1062-1, SUSE-SU-2025:03545-1, SUSE-SU-2024:4204-1
SLES 15 SP3 buildah 1.35.4-150300.8.25.1 SUSE-SU-2024:3120-1
SLES 15 SP3 docker 25.0.6_ce-150000.207.1 SUSE-SU-2025:1062-1, SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SLES 15 SP3 docker-stable 24.0.9_ce-150000.1.5.1 SUSE-SU-2025:1062-1, SUSE-SU-2025:03545-1, SUSE-SU-2024:4204-1
Show 19 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 15 SP2 docker 25.0.6_ce-150000.207.1 SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SLES 12 SP5 docker 26.1.5_ce-98.120.1 SUSE-SU-2025:1102-1, SUSE-SU-2024:4319-1
SLES 12 SP5 docker-stable 24.0.9_ce-1.5.1 SUSE-SU-2026:1118-1, SUSE-SU-2025:1102-1, SUSE-SU-2025:03540-1
SLES 12 docker 25.0.6_ce-98.115.1 SUSE-SU-2024:2709-1
SLES for SAP 15 SP5 docker 27.5.1_ce-150000.218.1 SUSE-SU-2025:1062-1
SLES for SAP 15 SP5 docker-stable 24.0.9_ce-150000.1.15.1 SUSE-SU-2025:1062-1, SUSE-SU-2025:03545-1
SLES for SAP 15 SP4 docker 25.0.6_ce-150000.207.1 SUSE-SU-2025:1062-1, SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SLES for SAP 15 SP4 docker-stable 24.0.9_ce-150000.1.5.1 SUSE-SU-2025:1062-1, SUSE-SU-2025:03545-1, SUSE-SU-2024:4204-1
SLES for SAP 15 SP3 buildah 1.35.4-150300.8.25.1 SUSE-SU-2024:3120-1
SLES for SAP 15 SP3 docker 25.0.6_ce-150000.207.1 SUSE-SU-2025:1062-1, SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SLES for SAP 15 SP3 docker-stable 24.0.9_ce-150000.1.5.1 SUSE-SU-2025:1062-1, SUSE-SU-2025:03545-1, SUSE-SU-2024:4204-1
SLES for SAP 15 SP2 docker 25.0.6_ce-150000.207.1 SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SLE Micro 6.1 docker 27.5.1_ce-slfo.1.1_1.1 SUSE-SU-2025:20259-1
SLE Micro 6.0 docker 25.0.6_ce-1.1 SUSE-SU-2025:20110-1, SUSE-SU-2025:20056-1
SLE Micro 5.5 docker 25.0.6_ce-150000.207.1 SUSE-SU-2025:1062-1, SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SLE Micro 5.4 docker 25.0.6_ce-150000.207.1 SUSE-SU-2025:1062-1, SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SLE Micro 5.3 docker 25.0.6_ce-150000.207.1 SUSE-SU-2025:1062-1, SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SLE Micro 5.2 docker 25.0.6_ce-150000.207.1 SUSE-SU-2025:1062-1, SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SLE Micro 5.1 docker 25.0.6_ce-150000.207.1 SUSE-SU-2025:1062-1, SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SLE HPC 15 SP5 docker 27.5.1_ce-150000.218.1 SUSE-SU-2025:1062-1
SLE HPC 15 SP5 docker-stable 24.0.9_ce-150000.1.15.1 SUSE-SU-2025:1062-1, SUSE-SU-2025:03545-1
SLE HPC 15 SP4 docker 25.0.6_ce-150000.207.1 SUSE-SU-2025:1062-1, SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SLE HPC 15 SP4 docker-stable 24.0.9_ce-150000.1.5.1 SUSE-SU-2025:1062-1, SUSE-SU-2025:03545-1, SUSE-SU-2024:4204-1
SLE HPC 15 SP3 buildah 1.35.4-150300.8.25.1 SUSE-SU-2024:3120-1
SLE HPC 15 SP3 docker 25.0.6_ce-150000.207.1 SUSE-SU-2025:1062-1, SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SLE HPC 15 SP3 docker-stable 24.0.9_ce-150000.1.5.1 SUSE-SU-2025:1062-1, SUSE-SU-2025:03545-1, SUSE-SU-2024:4204-1
SLE HPC 15 SP2 docker 25.0.6_ce-150000.207.1 SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SUSE Enterprise Storage 7.1 buildah 1.35.4-150300.8.25.1 SUSE-SU-2024:3120-1
SUSE Enterprise Storage 7.1 docker 25.0.6_ce-150000.207.1 SUSE-SU-2025:1062-1, SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
SUSE Enterprise Storage 7.1 docker-stable 24.0.9_ce-150000.1.5.1 SUSE-SU-2025:1062-1, SUSE-SU-2025:03545-1, SUSE-SU-2024:4204-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed apptainer 1.3.6-5.1 openSUSE-SU-2025:14909-1
openSUSE Tumbleweed docker 26.1.5_ce-1.1 openSUSE-SU-2024:14229-1
openSUSE Tumbleweed docker-stable 24.0.9_ce-1.1 openSUSE-SU-2024:14446-1
openSUSE Tumbleweed nova 3.10.0-1.1 openSUSE-SU-2024:14235-1
openSUSE Leap 15.6 apptainer 1.3.6-150600.4.9.1 SUSE-SU-2025:0980-1
openSUSE Leap 15.6 docker 25.0.6_ce-150000.207.1 SUSE-SU-2025:1062-1, SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
openSUSE Leap 15.6 docker-stable 24.0.9_ce-150000.1.5.1 SUSE-SU-2026:0972-1, SUSE-SU-2025:1062-1, SUSE-SU-2025:03545-1
openSUSE Leap 15.5 docker 25.0.6_ce-150000.207.1 SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1
openSUSE Leap 15.5 docker-stable 24.0.9_ce-150000.1.5.1 SUSE-SU-2024:4204-1, SUSE-RU-2024:4391-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.5 docker 25.0.6_ce-150000.207.1 SUSE-SU-2024:4360-1, SUSE-SU-2024:3120-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 docker 27.1.1-r0 —
Alpine v3.23 docker 27.1.1-r0 —
Alpine v3.22 docker 27.1.1-r0 —
Alpine v3.21 docker 27.1.1-r0 —
Alpine v3.20 docker 26.1.5-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-cloudwatch-agent 1.300044.0-1.amzn2023 ALAS2023-2024-708
Amazon Linux 2023 docker 25.0.6-1.amzn2023.0.1 ALAS2023-2024-674
Amazon Linux 2 amazon-cloudwatch-agent 1.300044.0-1.amzn2 ALAS2-2024-2630

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 moby-engine 25.0.3-5 —
Azure Linux 2 (CBL-Mariner) moby-engine 24.0.9-7 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r16 —
Wolfi rolling apko 0.17.0-r1 —
Wolfi rolling argo-workflows 3.6.5-r2 —
Wolfi rolling bom 0.6.0-r8 —
Wolfi rolling buf 1.35.1-r1 —
Wolfi rolling buildah 1.37.0-r0 —
Wolfi rolling buildctl +1 0.20.1-r3 —
Wolfi rolling cadvisor 0.50.0-r0 —
Wolfi rolling cert-manager-cmctl 2.1.0-r3 —
Wolfi rolling chartmuseum 0.16.2-r4 —
Wolfi rolling cilium-cli 0.16.15-r1 —
Wolfi rolling cosign 2.3.0-r1 —
Wolfi rolling crictl +2 1.30.1-r2 —
Wolfi rolling crossplane-crank 1.16.0-r3 —
Wolfi rolling ctop 0.7.7-r17 —
Wolfi rolling dagdotdev 0.0.4-r1 —
Wolfi rolling dagger 0.12.3-r0 —
Wolfi rolling dive 0.12.0-r10 —
Wolfi rolling docker-compose 2.29.1-r0 —
Wolfi rolling docker-credential-gcr 2.1.23-r1 —
Wolfi rolling eksctl 0.188.0-r0 —
Wolfi rolling falcoctl 0.8.0-r5 —
Wolfi rolling flux 2.3.0-r5 —
Wolfi rolling flux-helm-controller +1 1.0.1-r5 —
Wolfi rolling flux-image-reflector-controller +1 0.32.0-r6 —
Wolfi rolling flux-source-controller +1 1.3.0-r6 —
Wolfi rolling gh +1 2.53.0-r1 —
Wolfi rolling gitsign +2 0.10.2-r5 —
Wolfi rolling goreleaser 2.1.0-r1 —
Wolfi rolling grafana-alloy 1.3.0-r0 —
Wolfi rolling grype 0.79.3-r1 —
Wolfi rolling guac +4 0.8.0-r1 —
Wolfi rolling harbor-scanner-trivy 0.31.3-r3 —
Wolfi rolling helm 3.15.3-r1 —
Wolfi rolling helm-3 3.19.2-r1 —
Wolfi rolling helm-4 4.0.1-r1 —
Wolfi rolling helm-operator +1 1.36.0-r1 —
Wolfi rolling helm-push 0.10.4-r13 —
Wolfi rolling k3d +2 5.7.2-r1 —
Wolfi rolling k3s +2 1.30.3.1-r0 —
Wolfi rolling k8sgpt 0.3.39-r1 —
Wolfi rolling k9s 0.32.5-r3 —
Wolfi rolling kaniko 1.25.3-r2 —
Wolfi rolling kargo +1 0.8.1-r1 —
Wolfi rolling ko 0.15.4-r5 —
Wolfi rolling kots +2 1.112.2-r1 —
Wolfi rolling kpt 1.0.0_beta49-r9 —
Wolfi rolling kubeflow-katib +17 0.17.0-r13 —
Wolfi rolling kubescape 3.0.15-r1 —
Wolfi rolling melange 0.11.2-r2 —
Wolfi rolling nerdctl 1.7.6-r7 —
Wolfi rolling neuvector-scanner +2 0_git20240528-r6 —
Wolfi rolling neuvector-sigstore-interface 0_git20240801-r0 —
Wolfi rolling newrelic-infrastructure-agent 1.55.2-r0 —
Wolfi rolling opentelemetry-collector 0.139.0-r0 —
Wolfi rolling opentelemetry-collector-contrib 0.105.0-r0 —
Wolfi rolling paranoia 0.2.1-r17 —
Wolfi rolling policy-controller +1 0.9.0-r7 —
Wolfi rolling rancher-fleet +4 0.10.0-r2 —
Wolfi rolling scorecard 5.0.0-r0 —
Wolfi rolling skaffold 2.14.0-r0 —
Wolfi rolling skopeo 1.16.0-r0 —
Wolfi rolling slsa-verifier 2.6.0-r1 —
Wolfi rolling syft 1.10.0-r0 —
Wolfi rolling tekton-chains 0.21.1-r4 —
Wolfi rolling timoni 0.22.0-r2 —
Wolfi rolling tkn 0.37.0-r5 —
Wolfi rolling trivy 0.54.0-r0 —
Wolfi rolling up 0.31.0-r3 —
Wolfi rolling vcluster +2 0.19.7-r1 —
Wolfi rolling vexctl 0.2.6-r11 —
Wolfi rolling wolfictl 0.21.0-r1 —
Wolfi rolling zarf 0.38.0-r0 —
Wolfi rolling zot 2.1.0-r2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/docker/docker >= 19.03.0, < 23.0.15 23.0.15 GHSA-v23v-6jw2-98fq
Go github.com/docker/docker >= 26.0.0, < 26.1.5 26.1.5 GHSA-v23v-6jw2-98fq
Go github.com/docker/docker >= 27.0.0, < 27.1.1 27.1.1 GHSA-v23v-6jw2-98fq
Go github.com/docker/docker >= 24.0.0, < 25.0.6 25.0.6 GHSA-v23v-6jw2-98fq
Go github.com/docker/docker >= 20.10.0+incompatible, < 25.0.6+incompatible · >= 26.0.0+incompatible, < 26.1.5+incompatible · >= 27.0.0+incompatible, < 27.1.1+incompatible 25.0.6+incompatible, 26.1.5+incompatible, 27.1.1+incompatible GO-2024-3005
Go github.com/moby/moby >= 20.10.0+incompatible, < 25.0.6+incompatible · >= 26.0.0+incompatible, < 26.1.5+incompatible · >= 27.0.0+incompatible, < 27.1.1+incompatible 25.0.6+incompatible, 26.1.5+incompatible, 27.1.1+incompatible GO-2024-3005

Advisories 34

References