Fedora 38 update for moby-engine

1) Missing Authorization

EUVDB-ID: #VU80033

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-41803

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation when handling auto-config requests. A remote authenticated user can craft an auto-config request that allows the TLS certificate and ACL token to be generated for a node name not intended by the operator. This forces Consul to store unintended information, which can be repeatedly abused to cause an authenticated denial of service attack from a malicious operator.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 38

moby-engine: before 24.0.5-1.fc38

External links

http://bodhi.fedoraproject.org/updates/FEDORA-2023-9f5f1ef40a

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource exhaustion

EUVDB-ID: #VU72314

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3064

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when parsing large YAML documents. A remote attacker can consume excessive amounts of CPU or memory and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 38

moby-engine: before 24.0.5-1.fc38

External links

http://bodhi.fedoraproject.org/updates/FEDORA-2023-9f5f1ef40a

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Unchecked Return Value

EUVDB-ID: #VU80034

Risk: Low

CVSSv3.1: 3.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-40716

CWE-ID: CWE-252 - Unchecked Return Value

Exploit availability: No

Description

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to an error when handling CSR requests at the RPC endpoint. A remote user with access to a client agent’s mTLS certificate and a valid ACL token for any service within the mesh can send a specially crafted certificate signing request (CSR) to the Consul’s internal RPC endpoint and bypass intended ACL token restrictions.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 38

moby-engine: before 24.0.5-1.fc38

External links

http://bodhi.fedoraproject.org/updates/FEDORA-2023-9f5f1ef40a

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU80038

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0845

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote user with service:write permissions can configure the upstreams to reference a peering destination and crash the Consul server or client agent hosting the xDS connection to an API gateway or ingress gateway.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 38

moby-engine: before 24.0.5-1.fc38

External links

http://bodhi.fedoraproject.org/updates/FEDORA-2023-9f5f1ef40a

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper Privilege Management

EUVDB-ID: #VU72320

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-25173

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper privilege management where supplementary groups are not set up properly inside a container. A local user can use supplementary group access to bypass primary group restrictions and compromise the container.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 38

moby-engine: before 24.0.5-1.fc38

External links

http://bodhi.fedoraproject.org/updates/FEDORA-2023-9f5f1ef40a

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Insufficiently protected credentials

EUVDB-ID: #VU74150

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-26054

CWE-ID: CWE-522 - Insufficiently Protected Credentials

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to BuildKit may expose sensitive information when the user sends a build request that contains a Git URL with credentials and the build creates a provenance attestation  describing that build. A remote attacker can gain access to sensitive information.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 38

moby-engine: before 24.0.5-1.fc38

External links

http://bodhi.fedoraproject.org/updates/FEDORA-2023-9f5f1ef40a

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Unprotected Alternate Channel

EUVDB-ID: #VU74468

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-28840

CWE-ID: CWE-420 - Unprotected Alternate Channel

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to unprotected alternate channel within encrypted overlay networks. A remote attacker can inject arbitrary Ethernet frames into the encrypted overlay network and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 38

moby-engine: before 24.0.5-1.fc38

External links

http://bodhi.fedoraproject.org/updates/FEDORA-2023-9f5f1ef40a

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Missing Encryption of Sensitive Data

EUVDB-ID: #VU74467

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-28841

CWE-ID: CWE-311 - Missing Encryption of Sensitive Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to missing encryption of sensitive data within the overlay network driver. A remote attacker can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 38

moby-engine: before 24.0.5-1.fc38

External links

http://bodhi.fedoraproject.org/updates/FEDORA-2023-9f5f1ef40a

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Unprotected Alternate Channel

EUVDB-ID: #VU74469

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-28842

CWE-ID: CWE-420 - Unprotected Alternate Channel

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to unprotected alternate channel within encrypted overlay networks. A remote attacker can inject arbitrary Ethernet frames into the encrypted overlay network by encapsulating them in VXLAN datagrams.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 38

moby-engine: before 24.0.5-1.fc38

External links

http://bodhi.fedoraproject.org/updates/FEDORA-2023-9f5f1ef40a

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.