Docker Engine vulnerabilities

In Docker Engine versions 28.2.0 through 28.3.2, reloading the firewalld service removes all iptables rules including those created by Docker. Versions before 28.3.3 fail to recreate the rules blocking external access to containers, so containers with ports published to localhost become accessible from remote machines with routing to the Docker bridge. This is fixed in version 28.3.3.

Docker Engine version 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.

Docker Engine before version 1.6.1 uses weak permissions for several system directories, allowing local users to modify the host and obtain sensitive information.

Vulnerability in Docker Engine regarding incorrect classification of a registry as insecure. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default, and isCIDRMatch returns true if any host address matches. An attacker can use a DNS answer with a loopback IP and an attacker IP to disable certificate verification and enable HTTP fallback.