Docker security fix timeline
Public commits from moby/moby whose messages cite a vulnerability or a security fix. Patch text is not stored.
53 security-fix timeline events
Jan 20, 2025 · CVE-2024-45341
update to go1.23.5 (fix CVE-2024-45341, CVE-2024-45336)
update to go1.23.5 (fix CVE-2024-45341, CVE-2024-45336) go1.23.5 (released 2025-01-16) includes security fixes to the crypto/x509 and net/http packages, as well as bug fixes to the compiler, the runtime, and the net package. See the Go 1.23.5 milestone on our issue tracker for…
Dec 19, 2024 · CVE-2024-45338
vendor: golang.org/x/net v0.33.0
vendor: golang.org/x/net v0.33.0 contains a fix for CVE-2024-45338 / https://go.dev/issue/70906, but it doesn't affect our codebase: govulncheck -show=verbose ./... Scanning your code and 1260 packages across 211 dependent modules for known vulnerabilities... ... Vulnerabi…
Dec 11, 2024 · CVE-2024-45337
vendor: golang.org/x/crypto v0.31.0
vendor: golang.org/x/crypto v0.31.0 update to the latest version of this dependency, which has a fix for a authorization bypass in the ssh package. We don't use this functionality, so there's no need to backport this change (other than de-noising false positives). This is CVE-…
Sep 5, 2024 · CVE-2024-34155
update to go1.22.7
update to go1.22.7 - https://github.com/golang/go/issues?q=milestone%3AGo1.22.7+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.22.6...go1.22.7 These minor releases include 3 security fixes following the security policy: - go/parser: stack exh…
Sep 3, 2024 · CVE-2024-45310
vendor: github.com/opencontainers/runc v1.1.14
vendor: github.com/opencontainers/runc v1.1.14 diff: https://github.com/opencontainers/runc/compare/v1.1.13...v1.1.14 Release Notes: - Fix CVE-2024-45310 / GHSA-jfvp-7x6p-h2pv, a low-severity attack that allowed maliciously configured containers to create empty files and dire…
Sep 3, 2024 · CVE-2024-45310
update runc binary to 1.1.14
update runc binary to 1.1.14 Update the runc binary that's used in CI and for the static packages. diff: https://github.com/opencontainers/runc/compare/v1.1.13...v1.1.14 Release Notes: - Fix CVE-2024-45310, a low-severity attack that allowed maliciously configured containers…
Jul 3, 2024 · CVE-2024-24791
update to go1.21.12
update to go1.21.12 - https://github.com/golang/go/issues?q=milestone%3AGo1.21.12+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.21.11...go1.21.12 These minor releases include 1 security fixes following the security policy: net/http: denial o…
Jun 4, 2024 · CVE-2024-24789
update to go1.21.11
update to go1.21.11 go1.21.11 (released 2024-06-04) includes security fixes to the archive/zip and net/netip packages, as well as bug fixes to the compiler, the go command, the runtime, and the os package. See the Go 1.21.11 milestone on our issue tracker for details; - https:…
May 8, 2024 · CVE-2024-24787
update to go1.21.10
update to go1.21.10 - https://github.com/golang/go/issues?q=milestone%3AGo1.21.10+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.21.9...go1.21.10 These minor releases include 2 security fixes following the security policy: - cmd/go: arbitrary…
Apr 3, 2024 · CVE-2023-45288
update to go1.21.9
update to go1.21.9 go1.21.9 (released 2024-04-03) includes a security fix to the net/http package, as well as bug fixes to the linker, and the go/types and net/http packages. See the [Go 1.21.9 milestone](https://github.com/golang/go/issues?q=milestone%3AGo1.21.9+label%3ACherry…