CVE-2023-28840
published 2023-04-04CVE-2023-28840: Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream…
PriorityP359high8.7CVSS 3.1
AVNACHPRNUINSCCNIHAH
EPSS
2.73%
84.3th percentile
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in dockerd and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code.
The overlay network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes.
Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption.
When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the u32 iptables extension provided by the xt_u32 kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN.
Two iptables rules serve to filter incoming VXLAN datagrams with a
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | docker.io | < docker.io 20.10.24+dfsg1-1 (bookworm) | docker.io 20.10.24+dfsg1-1 (bookworm) |
| github.com | docker_docker | >= 1.12.0 < 20.10.24 | 20.10.24 |
| github.com | docker_docker | >= 1.12.0 < 20.10.24+incompatible | 20.10.24+incompatible |
| github.com | docker_docker | >= 23.0.0 < 23.0.3 | 23.0.3 |
| github.com | docker_docker | >= 23.0.0+incompatible < 23.0.3+incompatible | 23.0.3+incompatible |
| moby | moby | — | — |
| moby | moby | — | — |
| mobyproject | moby | >= 1.12.0 < 20.10.24 | 20.10.24 |
| mobyproject | moby | >= 23.0.0 < 23.0.3 | 23.0.3 |
CVSS provenance
nvdv3.18.7HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
osv8.7HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Docker vulnerabilities
vendor_ubuntu·2025-05-01·CVSS 7.5
CVE-2023-28840 [HIGH] Docker vulnerabilities
Title: Docker vulnerabilities
Summary: Several security issues were fixed in Docker.
Cory Snider discovered that Docker incorrectly handled networking packet
encapsulation. An attacker could use this issue to inject internet
packets in established connection, possibly causing a denial of service or
bypassing firewall protections. This issue only affected Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. (CVE-2023-28840, CVE-2023-28841,
CVE-2023-28842)
Rory McNamara discovered that Docker incorrectly handled cache in the
BuildKit toolkit. An attacker could possibly use this issue to expose
sensitive information. (CVE-2024-23651)
It was discovered that Docker incorrectly handled parallel operations in
some circumstances, which could possibly lead to undefined behavior.
(CVE-2024-
Red Hat
moby: Encrypted overlay network may be unauthenticated
vendor_redhat·2023-04-04·CVSS 7.5
CVE-2023-28840 [HIGH] CWE-420 moby: Encrypted overlay network may be unauthenticated
moby: Encrypted overlay network may be unauthenticated
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in dockerd and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code.
The overlay network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of V
Debian
CVE-2023-28840: docker.io - Moby is an open source container framework developed by Docker Inc. that is dist...
vendor_debian·2023·CVSS 7.5
CVE-2023-28840 [HIGH] CVE-2023-28840: docker.io - Moby is an open source container framework developed by Docker Inc. that is dist...
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in dockerd and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The overlay network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in
OSV
docker.io vulnerabilities
osv·2025-05-01·CVSS 8.7
CVE-2023-28840 [HIGH] docker.io vulnerabilities
docker.io vulnerabilities
Cory Snider discovered that Docker incorrectly handled networking packet
encapsulation. An attacker could use this issue to inject internet
packets in established connection, possibly causing a denial of service or
bypassing firewall protections. This issue only affected Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. (CVE-2023-28840, CVE-2023-28841,
CVE-2023-28842)
Rory McNamara discovered that Docker incorrectly handled cache in the
BuildKit toolkit. An attacker could possibly use this issue to expose
sensitive information. (CVE-2024-23651)
It was discovered that Docker incorrectly handled parallel operations in
some circumstances, which could possibly lead to undefined behavior.
(CVE-2024-36621, CVE-2024-36623)
Rory McNamara discovered that Docker
OSV
Docker Swarm encrypted overlay network may be unauthenticated in github.com/docker/docker
osv·2024-08-20
CVE-2023-28840 Docker Swarm encrypted overlay network may be unauthenticated in github.com/docker/docker
Docker Swarm encrypted overlay network may be unauthenticated in github.com/docker/docker
Docker Swarm encrypted overlay network may be unauthenticated in github.com/docker/docker
OSV
Docker Swarm encrypted overlay network with a single endpoint is unauthenticated
osv·2023-04-04
CVE-2023-28842 [MEDIUM] Docker Swarm encrypted overlay network with a single endpoint is unauthenticated
Docker Swarm encrypted overlay network with a single endpoint is unauthenticated
[Moby](https://mobyproject.org/) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of [SwarmKit](https://github.com/moby/swarmkit) and supporting network code.
The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtu
OSV
Docker Swarm encrypted overlay network may be unauthenticated
osv·2023-04-04
CVE-2023-28840 [HIGH] Docker Swarm encrypted overlay network may be unauthenticated
Docker Swarm encrypted overlay network may be unauthenticated
[Moby](https://mobyproject.org/) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of [SwarmKit](https://github.com/moby/swarmkit) and supporting network code.
The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow
OSV
Docker Swarm encrypted overlay network traffic may be unencrypted
osv·2023-04-04
CVE-2023-28841 [MEDIUM] Docker Swarm encrypted overlay network traffic may be unencrypted
Docker Swarm encrypted overlay network traffic may be unencrypted
[Moby](https://mobyproject.org/) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of [SwarmKit](https://github.com/moby/swarmkit) and supporting network code.
The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that al
GHSA
Docker Swarm encrypted overlay network traffic may be unencrypted
ghsa·2023-04-04
CVE-2023-28841 [MEDIUM] CWE-311 Docker Swarm encrypted overlay network traffic may be unencrypted
Docker Swarm encrypted overlay network traffic may be unencrypted
[Moby](https://mobyproject.org/) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of [SwarmKit](https://github.com/moby/swarmkit) and supporting network code.
The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that al
OSV
CVE-2023-28840: Moby is an open source container framework developed by Docker Inc
osv·2023-04-04·CVSS 8.7
CVE-2023-28840 [HIGH] CVE-2023-28840: Moby is an open source container framework developed by Docker Inc
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in dockerd and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The overlay network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in
GHSA
Docker Swarm encrypted overlay network with a single endpoint is unauthenticated
ghsa·2023-04-04
CVE-2023-28842 [MEDIUM] CWE-420 Docker Swarm encrypted overlay network with a single endpoint is unauthenticated
Docker Swarm encrypted overlay network with a single endpoint is unauthenticated
[Moby](https://mobyproject.org/) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of [SwarmKit](https://github.com/moby/swarmkit) and supporting network code.
The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtu
GHSA
Docker Swarm encrypted overlay network may be unauthenticated
ghsa·2023-04-04
CVE-2023-28840 [HIGH] CWE-420 Docker Swarm encrypted overlay network may be unauthenticated
Docker Swarm encrypted overlay network may be unauthenticated
[Moby](https://mobyproject.org/) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of [SwarmKit](https://github.com/moby/swarmkit) and supporting network code.
The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333https://github.com/moby/moby/issues/43382https://github.com/moby/moby/pull/45118https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mphttps://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5phttps://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxwhttps://lists.fedoraproject.org/archives/list/[email protected]/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/https://lists.fedoraproject.org/archives/list/[email protected]/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/https://lists.fedoraproject.org/archives/list/[email protected]/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333https://github.com/moby/moby/issues/43382https://github.com/moby/moby/pull/45118https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mphttps://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5phttps://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxwhttps://lists.fedoraproject.org/archives/list/[email protected]/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/https://lists.fedoraproject.org/archives/list/[email protected]/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/https://lists.fedoraproject.org/archives/list/[email protected]/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/
2023-04-04
Published