Docker recently found a serious flaw in some versions of Docker Engine and raised a warning that attackers can bypass authorized plugins (AuthZ) under specific circumstances. The vulnerability is assigned a CVSS score of 10.0, indicating it’s the most severe and can be tracked as CVE-2024-41110.
When the Docker engine receives an API request with a content-length set to zero, it can cause an error. This can cause the docker daemon to route the request with no body to the AuthZ plugin, which might incorrectly approve the request.
The original bug was discovered in 2018 and fixed in Docker Engine v18.09.1, which was released in November 2019. However, this fix was not fixed in version 19.03 or later.
The bug affects Docker Engine versions up to and including v19.03.15, v20.10.27, v23.0.14, v24.0.9, v25.0.5, v26.0.2, v26.1.4, v27.0.3, v27.1.0
If you are using any of these versions, either upgrade docker engine or disable the AuthZ plugin to reduce this risk to your system.
Docker Engine v19.03.x and later users who do not rely on AuthZ plugins for access control, and those using all versions of Mirantis Container Runtime are not affected with this vulnerability. Docker commercial products and internal infrastructure are also not affected.
This vulnerability also affects Docker Desktop latest version 4.32.0 but the impact is not severe because the exploit needs access to the Docker API. Thus, Docker plans to include a fix in an upcoming release i.e Docker Desktop v4.33.0.
