GO-2024-2659
Data exfiltration from internal networks in github.com/docker/docker
At a glance
- Published
- Updated
- CVE
- CVE-2024-29018
- Aliases
- GHSA-mq39-4gv4-mvpx
Description
dockerd forwards DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics, networks marked as 'internal' can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/docker/docker | introduced 25.0.0+incompatible, fixed 25.0.5+incompatible, introduced 26.0.0-rc1+incompatible, fixed 26.0.0-rc3+incompatible |
References
- https://github.com/moby/moby/security/advisories/GHSA-mq39-4gv4-mvpx ADVISORY
- https://github.com/moby/moby/pull/46609 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |