[USN-7161-3] Docker vulnerability

-----BEGIN PGP SIGNATURE-----

wnsEABYIACMWIQSV2d7RU755utSnx3O7Ba3EKYsoKQUCZ/6dgAUDAAAAAAAKCRC7Ba3EKYsoKSke
AQC/LruerfpL3aozHyVqyixGpGD+zA7VNMqgCSfgWopHGAD/TgTx4PPBvG+tH8kLZgGC+FnRuOOB
uPnsynLhNCmy2AU=
=kOX1
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7161-3
April 15, 2025

Docker vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

docker.io could allow unintended access to network services

Software Description:
- docker.io: reusable Go packages included with Docker

Details:

USN-7161-1 and USN-7161-2 fixed CVE-2024-41110 for source package
docker.io in Ubuntu 18.04 LTS and for source package docker.io-app in
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 24.10.
This update fixes it for source package docker.io in Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 24.10. These updates only
address the docker library and not the docker.io application itself, which
was already patched in the previous USNs (USN-7161-1 and USN-7161-2).

Original advisory details:

 Yair Zak discovered that Docker could unexpectedly forward DNS requests
 from internal networks in an unexpected manner. An attacker could possibly
 use this issue to exfiltrate data by encoding information in DNS queries
 to controlled nameservers. This issue was only addressed for the source
 package docker.io-app in Ubuntu 24.04 LTS. (CVE-2024-29018)

 Cory Snider discovered that Docker did not properly handle authorization
 plugin request processing. An attacker could possibly use this issue to
 bypass authorization controls by forwarding API requests without their
 full body, leading to unauthorized actions. This issue was only addressed
 for the source package docker.io-app in Ubuntu 24.10 and
 Ubuntu 24.04 LTS, and the source package docker.io in Ubuntu 18.04 LTS.
 (CVE-2024-41110)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.10
  golang-github-docker-docker-dev  26.1.4+dfsg2-1ubuntu1.1

Ubuntu 24.04 LTS
  golang-github-docker-docker-dev  20.10.25+dfsg1-2ubuntu1+esm1
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  golang-github-docker-docker-dev  20.10.21-0ubuntu1~22.04.7+esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  golang-github-docker-docker-dev  20.10.21-0ubuntu1~20.04.6+esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7161-3
  https://ubuntu.com/security/notices/USN-7161-2
  https://ubuntu.com/security/notices/USN-7161-1
  CVE-2024-41110

Package Information:
https://launchpad.net/ubuntu/+source/docker.io/26.1.4+dfsg2-1ubuntu1.1