CVE-2023-28842
published 2023-04-04CVE-2023-28842: Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream…
PriorityP340medium6.8CVSS 3.1
AVNACHPRNUINSCCNIHAN
EPSS
1.44%
69.9th percentile
Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code.
The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes.
Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption.
When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN.
The `overlay` driver dynamica
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | docker.io | < docker.io 20.10.24+dfsg1-1 (bookworm) | docker.io 20.10.24+dfsg1-1 (bookworm) |
| github.com | docker_docker | >= 1.12.0 < 20.10.24 | 20.10.24 |
| github.com | docker_docker | >= 1.12.0 < 20.10.24+incompatible | 20.10.24+incompatible |
| github.com | docker_docker | >= 23.0.0 < 23.0.3 | 23.0.3 |
| github.com | docker_docker | >= 23.0.0+incompatible < 23.0.3+incompatible | 23.0.3+incompatible |
| moby | moby | — | — |
| moby | moby | — | — |
| mobyproject | moby | >= 1.12.0 < 20.10.24 | 20.10.24 |
| mobyproject | moby | >= 23.0.0 < 23.0.3 | 23.0.3 |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
osv8.7HIGH
vendor_ubuntu7.5HIGH
vendor_debian6.8MEDIUM
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Docker vulnerabilities
vendor_ubuntu·2025-05-01·CVSS 7.5
CVE-2023-28840 [HIGH] Docker vulnerabilities
Title: Docker vulnerabilities
Summary: Several security issues were fixed in Docker.
Cory Snider discovered that Docker incorrectly handled networking packet
encapsulation. An attacker could use this issue to inject internet
packets in established connection, possibly causing a denial of service or
bypassing firewall protections. This issue only affected Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. (CVE-2023-28840, CVE-2023-28841,
CVE-2023-28842)
Rory McNamara discovered that Docker incorrectly handled cache in the
BuildKit toolkit. An attacker could possibly use this issue to expose
sensitive information. (CVE-2024-23651)
It was discovered that Docker incorrectly handled parallel operations in
some circumstances, which could possibly lead to undefined behavior.
(CVE-2024-
Red Hat
moby: Encrypted overlay network with a single endpoint is unauthenticated
vendor_redhat·2023-04-04·CVSS 6.8
CVE-2023-28842 [MEDIUM] CWE-420 moby: Encrypted overlay network with a single endpoint is unauthenticated
moby: Encrypted overlay network with a single endpoint is unauthenticated
Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code.
The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an i
Debian
CVE-2023-28842: docker.io - Moby) is an open source container framework developed by Docker Inc. that is dis...
vendor_debian·2023·CVSS 6.8
CVE-2023-28842 [MEDIUM] CVE-2023-28842: docker.io - Moby) is an open source container framework developed by Docker Inc. that is dis...
Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frame
OSV
docker.io vulnerabilities
osv·2025-05-01·CVSS 8.7
CVE-2023-28840 [HIGH] docker.io vulnerabilities
docker.io vulnerabilities
Cory Snider discovered that Docker incorrectly handled networking packet
encapsulation. An attacker could use this issue to inject internet
packets in established connection, possibly causing a denial of service or
bypassing firewall protections. This issue only affected Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. (CVE-2023-28840, CVE-2023-28841,
CVE-2023-28842)
Rory McNamara discovered that Docker incorrectly handled cache in the
BuildKit toolkit. An attacker could possibly use this issue to expose
sensitive information. (CVE-2024-23651)
It was discovered that Docker incorrectly handled parallel operations in
some circumstances, which could possibly lead to undefined behavior.
(CVE-2024-36621, CVE-2024-36623)
Rory McNamara discovered that Docker
OSV
Docker Swarm encrypted overlay network with a single endpoint is unauthenticated in github.com/docker/docker
osv·2024-08-20
CVE-2023-28842 Docker Swarm encrypted overlay network with a single endpoint is unauthenticated in github.com/docker/docker
Docker Swarm encrypted overlay network with a single endpoint is unauthenticated in github.com/docker/docker
Docker Swarm encrypted overlay network with a single endpoint is unauthenticated in github.com/docker/docker
OSV
Docker Swarm encrypted overlay network with a single endpoint is unauthenticated
osv·2023-04-04
CVE-2023-28842 [MEDIUM] Docker Swarm encrypted overlay network with a single endpoint is unauthenticated
Docker Swarm encrypted overlay network with a single endpoint is unauthenticated
[Moby](https://mobyproject.org/) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of [SwarmKit](https://github.com/moby/swarmkit) and supporting network code.
The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtu
OSV
Docker Swarm encrypted overlay network may be unauthenticated
osv·2023-04-04
CVE-2023-28840 [HIGH] Docker Swarm encrypted overlay network may be unauthenticated
Docker Swarm encrypted overlay network may be unauthenticated
[Moby](https://mobyproject.org/) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of [SwarmKit](https://github.com/moby/swarmkit) and supporting network code.
The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow
OSV
Docker Swarm encrypted overlay network traffic may be unencrypted
osv·2023-04-04
CVE-2023-28841 [MEDIUM] Docker Swarm encrypted overlay network traffic may be unencrypted
Docker Swarm encrypted overlay network traffic may be unencrypted
[Moby](https://mobyproject.org/) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of [SwarmKit](https://github.com/moby/swarmkit) and supporting network code.
The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that al
GHSA
Docker Swarm encrypted overlay network traffic may be unencrypted
ghsa·2023-04-04
CVE-2023-28841 [MEDIUM] CWE-311 Docker Swarm encrypted overlay network traffic may be unencrypted
Docker Swarm encrypted overlay network traffic may be unencrypted
[Moby](https://mobyproject.org/) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of [SwarmKit](https://github.com/moby/swarmkit) and supporting network code.
The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that al
GHSA
Docker Swarm encrypted overlay network with a single endpoint is unauthenticated
ghsa·2023-04-04
CVE-2023-28842 [MEDIUM] CWE-420 Docker Swarm encrypted overlay network with a single endpoint is unauthenticated
Docker Swarm encrypted overlay network with a single endpoint is unauthenticated
[Moby](https://mobyproject.org/) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of [SwarmKit](https://github.com/moby/swarmkit) and supporting network code.
The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtu
GHSA
Docker Swarm encrypted overlay network may be unauthenticated
ghsa·2023-04-04
CVE-2023-28840 [HIGH] CWE-420 Docker Swarm encrypted overlay network may be unauthenticated
Docker Swarm encrypted overlay network may be unauthenticated
[Moby](https://mobyproject.org/) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as *Docker*.
Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of [SwarmKit](https://github.com/moby/swarmkit) and supporting network code.
The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow
OSV
CVE-2023-28842: Moby) is an open source container framework developed by Docker Inc
osv·2023-04-04·CVSS 6.8
CVE-2023-28842 [MEDIUM] CVE-2023-28842: Moby) is an open source container framework developed by Docker Inc
Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frame
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mphttps://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5phttps://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxwhttps://lists.fedoraproject.org/archives/list/[email protected]/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/https://lists.fedoraproject.org/archives/list/[email protected]/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/https://lists.fedoraproject.org/archives/list/[email protected]/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mphttps://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5phttps://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxwhttps://lists.fedoraproject.org/archives/list/[email protected]/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/https://lists.fedoraproject.org/archives/list/[email protected]/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/https://lists.fedoraproject.org/archives/list/[email protected]/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/
2023-04-04
Published