CVE-2020-13401: Improper Input Validation in Docker Engine
Summary
CVE-2020-13401: Improper Input Validation in Docker Engine. Affects github.com/docker/docker-ce versions < 19.03.11. Fixed in 19.03.11. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2020-13401 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker Engine is an open-source containerization platform that allows developers to automate the deployment and management of applications within containers. It provides an efficient and lightweight solution for isolating applications and their dependencies. Docker Engine is written in Go and is widely used in various software development and deployment scenarios. However, a vulnerability has been discovered in Docker Engine before version 19.03.11 that could potentially be exploited by an attacker within a container with the CAP_NET_RAW capability.
Vulnerability Detail
The vulnerability, identified as CVE-2020-13401, arises from improper input validation in Docker Engine. An attacker with the CAP_NET_RAW capability can craft IPv6 router advertisements, enabling them to spoof external IPv6 hosts, gain access to sensitive information, or cause a denial of service. This vulnerability poses a moderate risk and has a CVSS score of 6.0. It was first published on February 15, 2022, and last modified on March 2, 2023. The vulnerability is categorized under CWE-20, which relates to improper input validation.
How To Fix
Minimum fixed version
19.03.11
This is the first release that contains the fix.
go get github.com/docker/docker-ce@v19.03.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that containers do not have the CAP_NET_RAW capability unless it is explicitly required for their applications. Additionally, monitoring network traffic and implementing proper access controls can help detect and prevent potential attacks.
Conclusion
In conclusion, Docker Engine before version 19.03.11 is vulnerable to an improper input validation issue that can be exploited by an attacker within a container. To mitigate this vulnerability, it is crucial to update Docker Engine to the latest version and follow best practices for container security. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/docker-ce →
FAQ
Docker Engine is an open-source containerization platform that allows developers to automate the deployment and management of applications within containers.
This vulnerability allows an attacker within a container to craft IPv6 router advertisements, potentially leading to spoofing of external IPv6 hosts, unauthorized access to sensitive information, or denial of service.
The severity of this vulnerability is categorized as moderate, with a CVSS score of 6.0.
To fix this vulnerability, it is recommended to update Docker Engine to version 19.03.11 or later.
While there are no specific workarounds mentioned, users can mitigate the risk by ensuring that containers do not have the CAP_NET_RAW capability unless necessary and implementing proper network traffic monitoring and access controls.
