Summary

github.com/docker/docker/libnetwork is a package that provides a native Go implementation for connecting containers
Affected versions of this package are vulnerable to Improper Control of a Resource Through its Lifetime, allowing DNS requests from internal networks to be forwarded to an external nameserver, violating the documented expectation that the --internal option will "completely isolate" the internal network. An attacker in control of the authoritative nameserver for a domain could indirectly exfiltrate data through DNS queries made by a compromised container.

Products Confirmed Not Affected

• Brocade Fabric OS is Not Affected
  [Vex Status Code: Component_not_present]
• Brocade ASCG is Not Affected
  [VEX Justification: Vulnerable_code_cannot_be_contolled_by_adversary]
• Brocade SANnav is Not Affected
  [VEX justification: Inline_mitigations_already_exist]

Solution

• While Brocade SANnav is Not Affected, a security update is provided in Brocade SANnav 2.3.1a and 2.4.0
• While Brocade ASCG is not affected, a security update provided in Brocade ASCG 3.2.0

Revision History

Disclaimer

THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS SOLELY FOR INFORMATIONAL PURPOSES AND DOES NOT IMPLY ANY KIND OF GUARANTY OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. YOUR USE OF THE INFORMATION CONTAINED HEREIN IS AT YOUR OWN RISK. ALL INFORMATION PROVIDED HEREIN IS BASED ON BROCADE'S CURRENT KNOWLEDGE AND UNDERSTANDING OF THE VULNERABILITY AND IMPACT TO BROCADE HARDWARE AND SOFTWARE PRODUCTS. BROCADE RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.