CVE-2021-41089

NameCVE-2021-41089
DescriptionMoby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
docker.io (PTS)buster, buster (security)18.09.1+dfsg1-7.1+deb10u3vulnerable
bullseye20.10.5+dfsg1-1+deb11u2fixed
bookworm20.10.24+dfsg1-1fixed
sid, trixie20.10.25+dfsg1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
docker.iosourcebullseye20.10.5+dfsg1-1+deb11u1
docker.iosource(unstable)20.10.10+dfsg1-1

Notes

[buster] - docker.io <no-dsa> (Minor issue)
https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4

Search for package or bug name: Reporting problems