| Summary: | app-emulation/docker: DoS via repeatedly joining and quitting swarm cluster as a node | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED WONTFIX | ||
| Severity: | minor | CC: | admwiggin, williamh, xarthisius |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://bugzilla.redhat.com/show_bug.cgi?id=1364008 | ||
| Whiteboard: | B3 [noglsa] | ||
| Package list: | Runtime testing required: | --- | |
There is no vulnerability here. The apparent DoS was generated by the administrator adding to many workers to the cluster (or swarm in Docker), which required the proper administrative token in order to do so. |
From ${URL} : A denial of service vulnerability was found in the latest version of docker. A swarm can be rendered unavailable to join by repeatedly joining and disconnecting it with a node. References: http://seclists.org/oss-sec/2016/q3/198 @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.