CVE-2022-36109— Moby 安全漏洞

Moby vulnerability relating to supplementary group permissions

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

授权机制不正确

Moby 安全漏洞

Moby是一个开源项目，旨在推动软件的容器化，并帮助生态系统使容器技术主流化。 Moby 20.10.18之前版本存在安全漏洞，该漏洞源于补充组设置不正确。攻击者利用该漏洞获得对敏感信息的访问权限或获得在该容器中执行代码的能力。

N/A

N/A