VDB

CVE-2018-12608

CVE-2018-12608 PUBLISHED CVSS 7.5 HIGH

An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA (as opposed to one signed by the configured CA root certificate) to authenticate.

EPSS 0.92% · 58.8th percentile

Risk Scores

CVSS 3.0
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
0.92%
58.8th percentile

Affected Products

VendorProductVersions
Ubuntu:18.04:LTSdocker.io1.13.1-0ubuntu6, 17.03.2-0ubuntu1, 17.03.2-0ubuntu3
Ubuntu:16.04:LTSdocker.io0, 1.6.2~dfsg1-1ubuntu4, 1.10.2-0ubuntu4

Timeline

  • Sep 10, 2018 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Aug 25, 2021 EPSS Score
  • Oct 28, 2021 EPSS Score
  • Dec 30, 2021 EPSS Score
  • Mar 3, 2022 EPSS Score
  • May 5, 2022 EPSS Score
  • Jul 7, 2022 EPSS Score
  • Sep 9, 2022 EPSS Score
  • Nov 12, 2022 EPSS Score
  • Jan 14, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›