VDB
Sign up
MEDIUM6.5

GHSA-6fj5-m822-rqx8

moby docker daemon crash during image pull of malicious image

Quick fix

GHSA-6fj5-m822-rqx8 — github.com/moby/moby: upgrade to the fixed version with the command below.

go get github.com/moby/moby@v19.3.15

Details

### Impact

Pulling an intentionally malformed Docker image manifest crashes the `dockerd` daemon.

### Patches

Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.

### Credits

Maintainers would like to thank Josh Larsen, Ian Coldwater, Duffie Cooley, Rory McCune for working on the vulnerability and Brad Geesaman for responsibly disclosing it to security@docker.com.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/moby/moby
Introduced in: 0Fixed in: 19.3.15
Fixgo get github.com/moby/moby@v19.3.15
Go/github.com/moby/moby
Introduced in: 20.10.0-beta1Fixed in: 20.10.3
Fixgo get github.com/moby/moby@v20.10.3

References