Alerts This Week
Warning Icon 1 923
Alerts This Week
Warning Icon 1 923

SUSE: 2024:0587-1 Important: Docker Threat Fix and Security Details

suse
Calendar Grey February 22, 2024
Dist Suse Esm H88
Recent SUSE release tackles significant docker vulnerabilities. Upgrade immediately to protect your infrastructure against targeted risks today.
* bsc#1219267 * bsc#1219268 * bsc#1219438 Cross-References:

Summary

## This update for docker fixes the following issues: Vendor latest buildkit v0.11 including bugfixes for the following: * CVE-2024-23653: BuildKit API doesn't validate entitlement on container creation (bsc#1219438). * CVE-2024-23652: Fixed arbitrary deletion of files (bsc#1219268). * CVE-2024-23651: Fixed race condition in mount (bsc#1219267). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Containers Module 12 zypper in -t patch SUSE-SLE-Module-Containers-12-2024-587=1 ## Package List: * Containers Module 12 (ppc64le s390x x86_64) * docker-24.0.7_ce-98.106.1 * docker-debuginfo-24.0.7_ce-98.106.1

Topics%20covered

Topics Covered

security advisory important SUSE Linux bugfix threat fix container security docker

References

* bsc#1219267

* bsc#1219268

* bsc#1219438

Cross-

* CVE-2024-23651

* CVE-2024-23652

* CVE-2024-23653

CVSS scores:

* CVE-2024-23651 ( SUSE ): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2024-23651 ( NVD ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

* CVE-2024-23652 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

* CVE-2024-23652 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

* CVE-2024-23653 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2024-23653 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:

* Containers Module 12

* SUSE Linux Enterprise High Performance Computing 12 SP2

* SUSE Linux Enterprise High Performance Computing 12 SP3

* SUSE Linux Enterprise High Performance Computing 12 SP4

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2024:0587-1
Rating: important

Topics%20covered

Topics Covered

security advisory important SUSE Linux bugfix threat fix container security docker

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here