Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 590476 (CVE-2016-6595) - app-emulation/docker: DoS via repeatedly joining and quitting swarm cluster as a node
Summary: app-emulation/docker: DoS via repeatedly joining and quitting swarm cluster a...
Status: RESOLVED WONTFIX
Alias: CVE-2016-6595
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-04 15:29 UTC by Agostino Sarubbo
Modified: 2016-11-26 02:16 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-08-04 15:29:43 UTC
From ${URL} :

A denial of service vulnerability was found in the latest version of docker. A swarm can be rendered unavailable to join by repeatedly joining and 
disconnecting it with a node.

References:

http://seclists.org/oss-sec/2016/q3/198


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Aaron Bauman (RETIRED) gentoo-dev 2016-11-26 02:16:28 UTC
There is no vulnerability here.  The apparent DoS was generated by the administrator adding to many workers to the cluster (or swarm in Docker), which required the proper administrative token in order to do so.