Bug 2275812 (CVE-2018-12608)

Summary:	CVE-2018-12608 moby: cert signing bypass
Product:	[Other] Security Response	Reporter:	Nick Tait <ntait>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amctagga, aoconnor, bniver, flucifre, gmeno, gparvin, jwendell, lbainbri, mbenjamin, mhackett, njean, owatkins, pahickey, rcernich, rhaigner, security-response-team, sostapov, twalsh, vereddy
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	moby 17.06.0	Doc Type:	---
Doc Text:	A certificate signing vulnerability was found in Moby. This issue could allow an unauthenticated remote attacker to validate a TLS certificate using Certificate Authorities (CA) from the system instead of only by a specified client CA root, which could allow bypassing of some certificate authorization rules, reducing system integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2276002, 2276003, 2276004, 2276005, 2349080
Bug Blocks:	2275813

Description Nick Tait 2024-04-17 22:00:05 UTC

An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA (as opposed to one signed by the configured CA root certificate) to authenticate.

https://github.com/moby/moby/pull/33182

Comment 3 Nick Tait 2024-04-18 21:32:20 UTC

Created golang-github-docker tracking bugs for this issue:

Affects: fedora-all [bug 2276002]

Comment 5 errata-xmlrpc 2024-08-07 15:39:41 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Service Mesh 2.6 for RHEL 8
  Red Hat OpenShift Service Mesh 2.6 for RHEL 9

Via RHSA-2024:5094 https://access.redhat.com/errata/RHSA-2024:5094