CVE-2018-12608: High severity Mobyproject Moby vulnerability
An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA (as opposed to one signed by the configured CA root certificate) to authenticate.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-12608.
What is the severity of CVE-2018-12608?
The severity of CVE-2018-12608 is high, with a severity value of 7.5.
What is the affected software for CVE-2018-12608?
The affected software for CVE-2018-12608 is Mobyproject Moby version up to but not including 17.06.0.
How does CVE-2018-12608 impact Docker?
CVE-2018-12608 impacts Docker by allowing a client with any domain validated certificate signed by a system-trusted root CA to have access.
Is there a fix available for CVE-2018-12608?
Yes, there is a fix available for CVE-2018-12608. Please refer to the reference link for more information.