By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container (CVE-2024-29018)

Brocade SANnav

0 more products

25073

02 November 2024

02 November 2024

OPEN

MEDIUM

5.9 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE-2024-29018

Brocade Security Advisory ID

BSA-2024-2748

Component

Docker

 

 

Summary

github.com/docker/docker/libnetwork is a package that provides a native Go implementation for connecting containers
Affected versions of this package are vulnerable to Improper Control of a Resource Through its Lifetime, allowing DNS requests from internal networks to be forwarded to an external nameserver, violating the documented expectation that the --internal option will "completely isolate" the internal network. An attacker in control of the authoritative nameserver for a domain could indirectly exfiltrate data through DNS queries made by a compromised container.

  •  

Products Confirmed Not Affected

  • Brocade Fabric OS is Not Affected [Vex Status Code: Component_not_present]
  • Brocade ASCG is Not Affected [Vex Status Code: Component_not_present]
  • Brocade SANnav is Not Affected [VEX justification: Inline_mitigations_already_exist]

Solution

  • While Brocade SANnav is Not Affected, a security update is provided in Brocade SANnav 2.3.1a

Revision History

Version

Change

Date

1.0

Initial Publication

October 14, 2024

 

Disclaimer

THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS SOLELY FOR INFORMATIONAL PURPOSES AND DOES NOT IMPLY ANY KIND OF GUARANTY OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. YOUR USE OF THE INFORMATION CONTAINED HEREIN IS AT YOUR OWN RISK. ALL INFORMATION PROVIDED HEREIN IS BASED ON BROCADE'S CURRENT KNOWLEDGE AND UNDERSTANDING OF THE VULNERABILITY AND IMPACT TO BROCADE HARDWARE AND SOFTWARE PRODUCTS. BROCADE RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.