What is GHSA-qrqr-3x5j-2xw9?

GHSA-qrqr-3x5j-2xw9 is a security advisory published by GitHub Security Advisories with High severity. Docker Authentication Bypass

Which CVE IDs does GHSA-qrqr-3x5j-2xw9 cover?

GHSA-qrqr-3x5j-2xw9 covers the following CVE IDs: CVE-2018-12608. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qrqr-3x5j-2xw9?

GHSA-qrqr-3x5j-2xw9 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-qrqr-3x5j-2xw9?

GHSA-qrqr-3x5j-2xw9 affects 1 product, including: go/github.com/docker/docker:\u003c 17.06.0-ce.

GHSA-qrqr-3x5j-2xw9HighCVSS 7.5

Docker Authentication Bypass

Vendor

GitHub Security Advisories

Published

January 31, 2024

Last Modified

July 8, 2024

🔗 CVE IDs covered (1)

CVE-2018-12608 →

📋 Description

An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA (as opposed to one signed by the configured CA root certificate) to authenticate.

🎯 Affected products1

go/github.com/docker/docker:< 17.06.0-ce

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2018-12608
https://github.com/moby/moby/issues/33173
https://github.com/moby/moby/pull/33182
https://github.com/moby/moby/commit/190c6e8cf8b893874a33d83f78307f1bed0bfbcd
https://github.com/advisories/GHSA-qrqr-3x5j-2xw9