Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 499
Alerts This Week
Warning Icon 1 499

SUSE: 2024:0586-2 Important: Docker Security Issues Fixes

suse
Calendar Grey April 4, 2024
Scroller Suse
SUSE issues important security patch for Docker to address multiple security flaws. Access installation guidance for the update here.
* bsc#1219267 * bsc#1219268 * bsc#1219438 Cross-References:

Summary

## This update for docker fixes the following issues: Vendor latest buildkit v0.11 including bugfixes for the following: * CVE-2024-23653: BuildKit API doesn't validate entitlement on container creation (bsc#1219438). * CVE-2024-23652: Fixed arbitrary deletion of files (bsc#1219268). * CVE-2024-23651: Fixed race condition in mount (bsc#1219267). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Containers Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2024-586=1 ## Package List: * Containers Module 15-SP4 (aarch64 ppc64le s390x x86_64) * docker-debuginfo-24.0.7_ce-150000.193.1 * docker-24.0.7_ce-150000.193.1

Topics%20covered

Topics Covered

security advisory vulnerability important SUSE container security Docker

References

* bsc#1219267

* bsc#1219268

* bsc#1219438

Cross-

* CVE-2024-23651

* CVE-2024-23652

* CVE-2024-23653

CVSS scores:

* CVE-2024-23651 ( SUSE ): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2024-23651 ( NVD ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

* CVE-2024-23652 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

* CVE-2024-23652 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

* CVE-2024-23653 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2024-23653 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:

* Containers Module 15-SP4

* SUSE Linux Enterprise High Performance Computing 15 SP4

* SUSE Linux Enterprise Real Time 15 SP4

* SUSE Linux Enterprise Server 15 SP4

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2024:0586-2
Rating: important

Topics%20covered

Topics Covered

security advisory vulnerability important SUSE container security Docker

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.