CVE-2016-6595
First published: Wed Jan 04 2017(Updated: )
** DISPUTED ** The SwarmKit toolkit 1.12.0 for Docker allows remote authenticated users to cause a denial of service (prevention of cluster joins) via a long sequence of join and quit actions. NOTE: the vendor disputes this issue, stating that this sequence is not "removing the state that is left by old nodes. At some point the manager obviously stops being able to accept new nodes, since it runs out of memory. Given that both for Docker swarm and for Docker Swarmkit nodes are *required* to provide a secret token (it's actually the only mode of operation), this means that no adversary can simply join nodes and exhaust manager resources. We can't do anything about a manager running out of memory and not being able to add new legitimate nodes to the system. This is merely a resource provisioning issue, and definitely not a CVE worthy vulnerability."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Docker | =1.12.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-6595?
CVE-2016-6595 is classified as a denial of service vulnerability that affects the SwarmKit toolkit in Docker 1.12.0.
How do I fix CVE-2016-6595?
To mitigate CVE-2016-6595, users should upgrade to a version of Docker that is not vulnerable to this issue.
Who is affected by CVE-2016-6595?
CVE-2016-6595 affects remote authenticated users of Docker 1.12.0 using the SwarmKit toolkit.
What are the implications of CVE-2016-6595?
The implications of CVE-2016-6595 include the prevention of cluster joins, which can disrupt service availability.
Is there a workaround for CVE-2016-6595?
There is no official workaround for CVE-2016-6595, so upgrading Docker is the recommended action.
- agent/type
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/status
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- status/disputed
- vendor/docker
- canonical/docker
- version/docker/1.12.0