CVE-2021-41089

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the hosts filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
2.8 LOW
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
GitHub_MCNA
2.8 LOW
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 8%
VendorProductVersion
mobyprojectmoby
𝑥
< 20.10.9
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
docker.io
bullseye
20.10.5+dfsg1-1+deb11u2
fixed
buster
no-dsa
bullseye (security)
20.10.5+dfsg1-1+deb11u3
fixed
bookworm
20.10.24+dfsg1-1
fixed
trixie
26.1.5+dfsg1-2
fixed
sid
26.1.5+dfsg1-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
docker.io
jammy
Fixed 20.10.7-0ubuntu7
released
impish
Fixed 20.10.7-0ubuntu5
released
hirsute
Fixed 20.10.7-0ubuntu1~21.04.2
released
focal
Fixed 20.10.7-0ubuntu1~20.04.2
released
bionic
Fixed 20.10.7-0ubuntu1~18.04.2
released
xenial
Fixed 18.09.7-0ubuntu1~16.04.9+esm1
released
trusty
dne