PT-2018-11289

CVE-2018-12608

Published

2018-09-10

Updated

2024-01-31

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Docker Moby versions prior to 17.06.0

Description An issue was discovered where the Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA to authenticate.

Recommendations For versions prior to 17.06.0, update to version 17.06.0 or later to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Abergmann

Vendors

Affected products

Weakness enumeration

CWE-295: Improper Certificate Validation

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Related identifiers