Security features bypass in moby - CVE-2024-32473

Vulnerability identifier: #VU88854

CSH Severity: Medium

CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-32473

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target sytem.

The vulnerability exists due to the IPv6 is not disabled on network interfaces. A remote attacker can gain access to sensitive information or perform a denial of service (DoS) attack.

moby
openEuler
docker-engine
docker-engine-debugsource
docker-engine-debuginfo
IBM Observability with Instana

Install updates from vendor's website.

moby - update to 26.0.2
docker-engine - addressed in versions 18.09.0-265, 18.09.0-336
docker-engine-debugsource - update to 18.09.0-336
docker-engine-debuginfo - update to 18.09.0-336
IBM Observability with Instana - update to 279

• https://github.com/moby/moby/security/advisories/GHSA-x84c-p2g9-rqv9
• https://github.com/moby/moby/commit/7cef0d9cd1cf221d8c0b7b7aeda69552649e0642

• Security features bypass in Moby
• openEuler update for docker
• openEuler 22.03 LTS SP3 update for docker
• Multiple vulnerabilities in IBM Observability with Instana