CVE-2016-6595: Medium severity Docker docker vulnerability
DISPUTED The SwarmKit toolkit 1.12.0 for Docker allows remote authenticated users to cause a denial of service (prevention of cluster joins) via a long sequence of join and quit actions. NOTE: the vendor disputes this issue, stating that this sequence is not "removing the state that is left by old nodes. At some point the manager obviously stops being able to accept new nodes, since it runs out of memory. Given that both for Docker swarm and for Docker Swarmkit nodes are required to provide a secret token (it's actually the only mode of operation), this means that no adversary can simply join nodes and exhaust manager resources. We can't do anything about a manager running out of memory and not being able to add new legitimate nodes to the system. This is merely a resource provisioning issue, and definitely not a CVE worthy vulnerability."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6595?
CVE-2016-6595 is classified as a denial of service vulnerability that affects the SwarmKit toolkit in Docker 1.12.0.
How do I fix CVE-2016-6595?
To mitigate CVE-2016-6595, users should upgrade to a version of Docker that is not vulnerable to this issue.
Who is affected by CVE-2016-6595?
CVE-2016-6595 affects remote authenticated users of Docker 1.12.0 using the SwarmKit toolkit.
What are the implications of CVE-2016-6595?
The implications of CVE-2016-6595 include the prevention of cluster joins, which can disrupt service availability.
Is there a workaround for CVE-2016-6595?
There is no official workaround for CVE-2016-6595, so upgrading Docker is the recommended action.