Withdrawn by the publisher.
Affected: CleanStart: docker, CleanStart: docker-fips
CVE-2021-21284 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.
Affected: Go: github.com/moby/moby
### Impact
When using `--userns-remap`, if the root user in the remapped namespace has access to the host filesystem they can modify files under `/var/lib/docker/<remapping>` that cause writing files with extended privileges.
### Patches
Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.
### Credits
Maintainers would like to thank Alex Chapman for discovering the vulnerability; @awprice, @nathanburrell, @raulgomis, @chris-walz, @erin-jensby, @bassmatt, @mark-adams, @dbaxa for working on it and Zac Ellis for responsibly disclosing it to security@docker.com
Affected: openEuler:20.03-LTS: docker, openEuler:20.03-LTS-SP1: docker
Docker is an open source project to build, ship and run any application as a lightweight container. Docker containers are both hardware-agnostic and platform-agnostic. This means they can run anywhere, from your laptop to the largest EC2 compute instance and everything in between - and they don't require you to use a particular language, framework or packaging system. That makes them great building blocks for deploying and scaling web apps, databases, and backend services without depending on a particular stack or provider. Security Fix(es): In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using --userns-remap, if the root user in the remapped namespace has access to the host filesystem they can modify files under /var/lib/docker/<remapping> that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.(CVE-2021-21284) In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.(CVE-2021-21285)
Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork
Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork
Affected: Ubuntu:Pro:16.04:LTS: docker.io, Ubuntu:18.04:LTS: docker.io, Ubuntu:20.04:LTS: docker.io
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in docker ausnutzen, um seine Privilegien zu erhöhen und um einen Denial of Service Angriff durchzuführen.