Category Archives: Docker

Does it matter (and go widely unnoticed) that GitLab CI+docker-executor produces world-writable files, or do "we" need to raise awareness for that?

Posted on by

I have a vague feeling that there is a wide spread security problem which goes unnoticed. I’m trying to find out how to check the level of relevance and awareness out there or how to maybe raise it.
Situation:
When using GitLab CI with the… Continue reading Does it matter (and go widely unnoticed) that GitLab CI+docker-executor produces world-writable files, or do "we" need to raise awareness for that?→

Should I house my organization’s root CA certificate in public github repostiory?

Posted on by

We have a public repository of a software that uses Docker container. Any thing that runs within the organization sees certificates signed by our org’s root CA. For the container to run properly within our org, the root CA certificate need… Continue reading Should I house my organization’s root CA certificate in public github repostiory?→

DockerSpy: Search for images on Docker Hub, extract sensitive information

Posted on by

DockerSpy scans Docker Hub for images and retrieves sensitive information, including authentication secrets, private keys, and other confidential data. “DockerSpy was created to address the growing concern of sensitive data leaks within Docker im… Continue reading DockerSpy: Search for images on Docker Hub, extract sensitive information→

Does libc security vulnerabilities in a python web application are actually exploitable in a private cloud environment

Posted on by

We use a python web framework and gunicorn on top of docker to power a web application with frontend in a private cloud that can be accessed by a private network. Our security tools reports a lot of libc vulnerabilities for the debian base… Continue reading Does libc security vulnerabilities in a python web application are actually exploitable in a private cloud environment→

Docker fixes critical auth bypass flaw, again (CVE-2024-41110)

Posted on by

A critical-severity Docker Engine vulnerability (CVE-2024-41110) may be exploited by attackers to bypass authorization plugins (AuthZ) via specially crafted API request, allowing them to perform unauthorized actions, including privilege escalation. Abo… Continue reading Docker fixes critical auth bypass flaw, again (CVE-2024-41110)→

Docker Patches Critical AuthZ Plugin Bypass Vulnerability Dating Back to 2018

Posted on by

The vulnerability, tagged as CVE-2024-41110 with a CVSS severity score of 10/10, was originally found and fixed in 2018.
The post Docker Patches Critical AuthZ Plugin Bypass Vulnerability Dating Back to 2018 appeared first on SecurityWeek.
Continue reading Docker Patches Critical AuthZ Plugin Bypass Vulnerability Dating Back to 2018→