July 29th, 2024

Critical Bug in Docker Engine Allowed Attackers to Bypass Authorization Plugins

A critical vulnerability in Docker Engine allows attackers to bypass authorization, risking unauthorized access to containers. Organizations are urged to apply patches and enhance security measures to mitigate these risks.

Read original articleLink Icon
Critical Bug in Docker Engine Allowed Attackers to Bypass Authorization Plugins

A critical vulnerability in Docker Engine has been identified, allowing attackers to bypass authorization plugins. This flaw poses significant security risks as it enables unauthorized access to Docker containers, potentially leading to data breaches and system compromises. The vulnerability highlights the importance of maintaining robust security measures and timely updates for software applications. Organizations using Docker are advised to implement immediate patches and review their security protocols to mitigate the risks associated with this exploit. The incident underscores the ongoing challenges in cybersecurity, particularly in managing vulnerabilities in widely used software platforms. As cyber threats continue to evolve, it is crucial for companies to remain vigilant and proactive in their security strategies to protect sensitive data and maintain operational integrity.

Link Icon 5 comments
By @erickj - 6 months
Hmmm... It's as though running root privelege daemons with open sockets could go wrong. Who could have known.

https://developers.redhat.com/blog/2020/09/25/rootless-conta...

By @compsciphd - 6 months
Are there really good use cases for dockerd being exposed to the network?

I would assume (many/most) users who run docker directly run it without api access on the network (i.e. on a single host).

Even those that do want network deployments of docker, probably run it through something like k8s where again kubernetes is handling the networking side, and each dockerd doesn't need to expose a network accessible api).

just wondering the use case for this.

By @jroseattle - 6 months
> The vulnerability was addressed with the release of Docker Engine v18.09.1, but it was not included in subsequent major versions, causing a regression.

Without further information, this sounds like code introduced in a hotfix that wasn't merged back to feature branches.

Surely it's not that simple?

By @mass_and_energy - 6 months
How does this affect CaaS-based deployments like AKS, EKS, GKE and the like?