docker.io — security advisory

{
  "id": "af3079d6d42874952d32bf3b04aca12e9efea5287f087078ddd5d784b81114a0",
  "url": "https://osv.dev/vulnerability/DEBIAN-CVE-2023-28842",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "DEBIAN-CVE-2023-28842",
    "summary": "Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality thr",
    "evidence": "osv:DEBIAN-CVE-2023-28842",
    "products": [
      {
        "name": {
          "value": "docker.io",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "20.10.24+dfsg1-1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "docker.io",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "20.10.24+dfsg1-1",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "docker.io",
          "evidence": "/affected/2/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "20.10.24+dfsg1-1",
            "evidence": "/affected/2/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "DEBIAN-CVE-2023-28842",
      "aliases": [
        "DEBIAN-CVE-2023-28842"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "20.10.24+dfsg1-1"
                }
              ]
            }
          ],
          "package": {
            "name": "docker.io",
            "purl": "pkg:deb/debian/docker.io?arch=source&distro=bookworm",
            "ecosystem": "Debian:12"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-28842.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "20.10.24+dfsg1-1"
                }
              ]
            }
          ],
          "package": {
            "name": "docker.io",
            "purl": "pkg:deb/debian/docker.io?arch=source&distro=trixie",
            "ecosystem": "Debian:13"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-28842.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "20.10.24+dfsg1-1"
                }
              ]
            }
          ],
          "package": {
            "name": "docker.io",
            "purl": "pkg:deb/debian/docker.io?arch=source&distro=forky",
            "ecosystem": "Debian:14"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-28842.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        }
      ],
      "modified": "2026-10-26T18:01:03.426919308Z",
      "provider": "osv",
      "upstream": [
        "CVE-2023-28842"
      ],
      "references": [
        "https://security-tracker.debian.org/tracker/CVE-2023-28842"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2023-28842",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 455306,
  "published_at": "2023-04-04T22:15:08.007+00:00"
}