Most recent entries from all

bdu:2022-05641

Withdrawn: BELL-CVE-2022-36109 — CVE-2022-36109 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2025-avi-0622 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq…

certfr-2025-avi-0622

CLEANSTART-2026-MS11283 — Security fix for CVE-2022-36109 applied in: docker 20.10.18-r0, docker-fips 20.10.18-r0

Affected: CleanStart: docker, CleanStart: docker-fips

CVE-2022-36109 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-233733

fkie_cve-2022-36109

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly.

GHSA-rc4r-wh2q-q6c4 — Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions

Affected: Go: github.com/docker/docker

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Users should update to this version when it is available. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly.

Thanks to Steven Murdoch for reporting this issue.

----

### Impact

If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.

### Patches

This bug is fixed in Moby (Docker Engine) 20.10.18. Users should update to this version when it is available.

### Workarounds

This problem can be worked around by not using the `"USER $USERN…

gsd-2022-36109

OESA-2022-1936 — docker security update

Affected: openEuler:20.03-LTS-SP1: docker, openEuler:20.03-LTS-SP3: docker, openEuler:22.03-LTS: docker

Docker is an open source project to build, ship and run any application as a lightweight container. Security Fix(es): Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly.(CVE-2022-36109)

openSUSE-SU-2024:12790-1 — docker-20.10.23_ce-2.1 on GA media

docker-20.10.23_ce-2.1 on GA media

SUSE-SU-2023:0795-2 — Security update for docker

Security update for docker

UBUNTU-CVE-2022-36109

Affected: Ubuntu:Pro:16.04:LTS: docker.io, Ubuntu:18.04:LTS: docker.io, Ubuntu:20.04:LTS: docker.io, Ubuntu:22.04:LTS: docker.io

WID-SEC-W-2022-1738 — IBM InfoSphere Information Server: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.