Skip to content
Heist/ feed
Back to feed
Medium

External DNS requests from 'internal' networks could lead to data exfiltration

Type: advisorySources: OSV

Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well. When containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs. Containers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly. In addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container net

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2024-29018
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 08:55 UTC · Revision 1

Source evidence

External DNS requests from 'internal' networks could lead to data exfiltration

core-osv · Original source

Published 20 Mar 2024, 20:27 UTC

Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well. When containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs. Containers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly. In addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container net

osv:CVE-2024-29018
Complete source record
{
  "id": "a1092e578c9809f7e5abe64150d87947394b35d075a3082840b7255b2ceedc55",
  "url": "https://osv.dev/vulnerability/CVE-2024-29018",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "External DNS requests from 'internal' networks could lead to data exfiltration",
    "summary": "Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well. When containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs. Containers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly. In addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container net",
    "evidence": "osv:CVE-2024-29018",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2024-29018",
      "aliases": [
        "CVE-2024-29018",
        "GHSA-mq39-4gv4-mvpx",
        "GO-2024-2659"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/moby/moby",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "ab34280ac3c0001c0a64f358320eaae79dd1c9d7"
                },
                {
                  "introduced": "1331b8c39a601c77d678f3e03f3f39cb07aa5f76"
                },
                {
                  "fixed": "e63daec8672d77ac0b2b5c262ef525c7cf17fd20"
                },
                {
                  "introduced": "81428bf11b122325fd855d5c59fa83016f82986a"
                },
                {
                  "last_affected": "330d777c53fbbf734178d6a35c9dc0a5070ba4ac"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "23.0.11"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "24.0.0"
                      },
                      {
                        "fixed": "25.0.5"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:mobyproject:moby:26.0.0:rc1:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "26.0.0-rc1"
                      },
                      {
                        "last_affected": "26.0.0-rc1"
                      }
                    ],
                    "source": "CPE_STRING"
                  },
                  {
                    "cpe": "cpe:2.3:a:mobyproject:moby:26.0.0:rc2:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "26.0.0-rc2"
                      },
                      {
                        "last_affected": "26.0.0-rc2"
                      }
                    ],
                    "source": "CPE_STRING"
                  },
                  {
                    "cpe": "cpe:2.3:a:mobyproject:moby:26.0.0:rc3:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "26.0.0-rc3"
                      },
                      {
                        "last_affected": "26.0.0-rc3"
                      }
                    ],
                    "source": "CPE_STRING"
                  }
                ]
              }
            }
          ],
          "versions": [
            "26.0.0-rc1",
            "26.0.0-rc2",
            "26.0.0-rc3",
            "v23.0.1",
            "v26.0.0-rc3",
            "v26.0.0-rc2",
            "v25.0.4",
            "v23.0.10",
            "v26.0.0-rc1",
            "v25.0.3",
            "v25.0.2",
            "v25.0.1",
            "v25.0.0",
            "v25.0.0-rc.3",
            "v23.0.9",
            "v25.0.0-rc.2",
            "v25.0.0-rc.1",
            "v25.0.0-beta.3",
            "v25.0.0-beta.2",
            "v25.0.0-beta.1",
            "v23.0.8",
            "v23.0.7",
            "v24.0.0-rc.1",
            "v23.0.6",
            "v24.0.0-rc.2",
            "v23.0.5",
            "v23.0.4",
            "v24.0.0-beta.2",
            "v23.0.3",
            "v23.0.2",
            "v24.0.0-beta.1",
            "v23.0.0-rc.4",
            "v23.0.0",
            "v23.0.0-rc.3",
            "v23.0.0-rc.2",
            "v23.0.0-rc.1",
            "v23.0.0-beta.1",
            "v22.06.0-beta.0",
            "v20.10.2",
            "v20.10.1",
            "v20.10.0",
            "v20.10.0-rc2",
            "v20.10.0-rc1",
            "v20.10.0-beta1",
            "v19.03.0-beta3",
            "v19.03.0-beta2",
            "v19.03.0-beta1",
            "v18.09.0-ce-tp0",
            "v18.06.0-ce-rc1",
            "docs-v1.12.0-rc4-2016-07-15",
            "v0.7.2",
            "v0.7.1",
            "v0.7.0",
            "v0.6.5",
            "v0.5.0",
            "v0.4.7",
            "v0.4.5",
            "v0.4.4",
            "v0.4.2",
            "v0.4.1",
            "v0.3.2",
            "v0.3.1",
            "v0.3.0",
            "v0.2.2",
            "v0.2.1",
            "v0.2.0",
            "v0.1.8",
            "v0.1.7",
            "v0.1.6",
            "v0.1.5",
            "v0.1.4",
            "v0.1.3",
            "v0.1.2",
            "v0.1.1",
            "v0.1.0",
            "upstream/0.1.3",
            "0.0.3",
            "upstream/0.1.2"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29018.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:34.269122764Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29018.json",
        "https://github.com/moby/moby/security/advisories/GHSA-mq39-4gv4-mvpx",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-29018",
        "https://github.com/moby/moby/pull/46609"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-669"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29018.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-29018",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 501279,
  "published_at": "2024-03-20T20:27:00.491+00:00"
}