Bug 729208 (CVE-2020-13401)

Summary:	<app-emulation/docker-19.03.12: Address spoofing vulnerability (CVE-2020-13401)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	ajak, gyakovlev, williamh
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/docker/docker-ce/releases/tag/v19.03.11
Whiteboard:	B3 [glsa+ cve]
Package list:		Runtime testing required:	---

Description Sam James archtester

2020-06-22 22:17:58 UTC

Description:
"An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service."

Comment 1 Sam James archtester

2020-06-22 22:18:21 UTC

Please bump to 19.03.11.

Comment 2 Sam James archtester

2020-07-18 20:58:46 UTC

ping

Comment 3 Sam James archtester

2020-07-26 05:54:27 UTC

ping. Please bump to 19.03.11.

Comment 4 Larry the Git Cow gentoo-dev

2020-08-01 19:17:53 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7dbf23f4a87e5e05138d5f348bf26f2407518d89

commit 7dbf23f4a87e5e05138d5f348bf26f2407518d89
Author:     William Hubbs <williamh@gentoo.org>
AuthorDate: 2020-08-01 19:13:07 +0000
Commit:     William Hubbs <williamh@gentoo.org>
CommitDate: 2020-08-01 19:16:17 +0000

    app-emulation/docker: 19.03.12 security bump
    
    Bug: https://bugs.gentoo.org/729208
    Signed-off-by: William Hubbs <williamh@gentoo.org>

 app-emulation/docker/Manifest               |   1 +
 app-emulation/docker/docker-19.03.12.ebuild | 314 ++++++++++++++++++++++++++++
 2 files changed, 315 insertions(+)

Comment 5 Sam James archtester

2020-08-01 19:56:43 UTC

Thanks, please cleanup <19.03.12 when ready!

Comment 6 Larry the Git Cow gentoo-dev

2020-08-22 21:17:23 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c36679efd436befb08ce71b20194a55c1f4de0b5

commit c36679efd436befb08ce71b20194a55c1f4de0b5
Author:     William Hubbs <williamh@gentoo.org>
AuthorDate: 2020-08-22 21:15:58 +0000
Commit:     William Hubbs <williamh@gentoo.org>
CommitDate: 2020-08-22 21:16:15 +0000

    app-emulation/docker: remove old
    
    Bug: https://bugs.gentoo.org/729208
    Signed-off-by: William Hubbs <williamh@gentoo.org>

 app-emulation/docker/Manifest              |   1 -
 app-emulation/docker/docker-19.03.8.ebuild | 314 -----------------------------
 2 files changed, 315 deletions(-)

Comment 7 John Helmert III archtester

2020-08-23 00:30:45 UTC

Thanks.

Comment 8 GLSAMaker/CVETool Bot gentoo-dev

2020-08-26 21:44:04 UTC

This issue was resolved and addressed in
 GLSA 202008-15 at https://security.gentoo.org/glsa/202008-15
by GLSA coordinator Sam James (sam_c).