Why hackers 'first love' a docker container? Hacking Docker
Tags: docker, linux, showdev, devops
Published: 2020-06-04 19:19:32

How hackers know vulnerabilities of my docker containers?

Docker and containers are becoming ever more popular and settling into the standard toolkit of developers and ops folks. Docker runs as a daemon named “dockerd”, which serves as the top-level interface to Docker’s core functionality. The “docker” command line tool for example, talks to dockerd to get your task done. The API that dockerd exposes, variously called the Docker API or the Docker Remote API. *The port 2375 is the de-facto standard for the Docker API*. As it stands, the endpoint is unauthenticated and unencrypted. [see: IANA allocates port 2375 to docker]( https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=docker)

Now, let us go to a search engine to find the how many  docker daemons are available to hack via default port  2375 port of Docker. On 1 June 2020, at 11 Am , Indian Standard Time (GMT :+5.30) by using  shodan.io , ***I found 5,209 docker daemons are prone to hackers.*** 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/9q7neyxdlifa59hlsfgr.png)

**Top Docker hosts version with the remote API exposed publicly.
18.06.1-ce:  3,604
17.05.0-ce:  672
19.03.8:     293
1.13.1:      164
18.05.0-ce:  29**

**Even the latest Stable release 19.03.8 / March 10, 2020 is inviting hackers.**

###***But what hacker’s do with your docker container?***

The possibilities for attackers after spawning a container on hacked Docker hosts are endless. The most of the exposed Docker remote API IPs are running a cryptocurrency miner for a currency called Monero. Monero transactions are obfuscated, meaning it is nearly impossible to track the source, amount, or destination of a transaction.  Mining cryptocurrency is just one example. 

•	Access files on the Docker host and mounted volumes.
•	Scan the internal network
•	Credentials leakage
•	Data Leakage

They can also be used to:
•	Launch more attacks with masked IPs
•	Create a botnet
•	Host services for phishing campaigns
•	Steal credentials and data
•	Pivot attacks to the internal network.

Vulnerabilities related to docker / popular docker images:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/lfvi67p0dktvewv0gf0g.png)

LATEST DOCKER RELATED Vulnerabilities:(solutions at end)
<table border="1" class="table table-striped table-hover" data-testid="vuln-results-table">
			<tbody>
				<tr data-testid="vuln-row-0">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-0" href="https://nvd.nist.gov/vuln/detail/CVE-2020-13401">CVE-2020-13401</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-0">
							<span style="font-size:9px;">An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-0">June 02, 2020; 10:15:10 AM -04:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-critical" data-testid="vuln-cvss3-link-0" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2020-13401&amp;vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl01_Cvss3CalculatorAnchor">9.8 CRITICAL</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-danger" data-testid="vuln-cvss2-link-0" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2020-13401&amp;vector=(AV:N/AC:L/Au:N/C:P/I:P/A:P)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl01_Cvss2CalculatorAnchor">7.5 HIGH</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-1">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-1" href="https://nvd.nist.gov/vuln/detail/CVE-2020-11878">CVE-2020-11878</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-1">
							<span style="font-size:9px;">The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default passwords (such as passw0rd) for system accounts.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-1">April 17, 2020; 12:15:14 PM -04:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-critical" data-testid="vuln-cvss3-link-1" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2020-11878&amp;vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl02_Cvss3CalculatorAnchor">9.8 CRITICAL</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-danger" data-testid="vuln-cvss2-link-1" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2020-11878&amp;vector=(AV:N/AC:L/Au:N/C:P/I:P/A:P)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl02_Cvss2CalculatorAnchor">7.5 HIGH</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-3">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-3" href="https://nvd.nist.gov/vuln/detail/CVE-2020-10952">CVE-2020-10952</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-3">
							<span style="font-size:9px;">GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-3">March 27, 2020; 03:15:11 PM -04:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-warning" data-testid="vuln-cvss3-link-3" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2020-10952&amp;vector=AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl04_Cvss3CalculatorAnchor">6.5 MEDIUM</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-warning" data-testid="vuln-cvss2-link-3" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2020-10952&amp;vector=(AV:N/AC:M/Au:N/C:P/I:P/A:N)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl04_Cvss2CalculatorAnchor">5.8 MEDIUM</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-4">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-4" href="https://nvd.nist.gov/vuln/detail/CVE-2020-5252">CVE-2020-5252</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-4">
							<span style="font-size:9px;">The command-line &quot;safety&quot; package for Python has a potential security issue. There are two Python characteristics that allow malicious code to &ldquo;poison-pill&rdquo; command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages. This vulnerability is considered to be of low severity because the attack makes use of an existing Python condition, not the Safety tool itself. This can happen if: You are running Safety in a Python environment that you don&rsquo;t trust. You are running Safety from the same Python environment where you have your dependencies installed. Dependency packages are being installed arbitrarily or without proper verification. Users can mitigate this issue by doing any of the following: Perform a static analysis by installing Docker and running the Safety Docker image: $ docker run --rm -it pyupio/safety check -r requirements.txt Run Safety against a static dependencies list, such as the requirements.txt file, in a separate, clean Python environment. Run Safety from a Continuous Integration pipeline. Use PyUp.io, which runs Safety in a controlled environment and checks Python for dependencies without any need to install them. Use PyUp&#39;s Online Requirements Checker.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-4">March 23, 2020; 07:15:12 PM -04:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-warning" data-testid="vuln-cvss3-link-4" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2020-5252&amp;vector=AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl05_Cvss3CalculatorAnchor">4.1 MEDIUM</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-low" data-testid="vuln-cvss2-link-4" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2020-5252&amp;vector=(AV:L/AC:M/Au:N/C:N/I:P/A:N)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl05_Cvss2CalculatorAnchor">1.9 LOW</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-5">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-5" href="https://nvd.nist.gov/vuln/detail/CVE-2020-10665">CVE-2020-10665</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-5">
							<span style="font-size:9px;">Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes. This affects Docker Desktop Enterprise before 2.1.0.9, Docker Desktop for Windows Stable before 2.2.0.4, and Docker Desktop for Windows Edge before 2.2.2.0.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-5">March 18, 2020; 03:15:18 PM -04:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-warning" data-testid="vuln-cvss3-link-5" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2020-10665&amp;vector=AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl06_Cvss3CalculatorAnchor">6.7 MEDIUM</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-danger" data-testid="vuln-cvss2-link-5" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2020-10665&amp;vector=(AV:L/AC:L/Au:N/C:C/I:C/A:C)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl06_Cvss2CalculatorAnchor">7.2 HIGH</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-6">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-6" href="https://nvd.nist.gov/vuln/detail/CVE-2020-7606">CVE-2020-7606</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-6">
							<span style="font-size:9px;">docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within &#39;index.js&#39; of the package, the function &#39;exec(serviceName, cmd, fnStdout, fnStderr, fnExit)&#39; uses the variable &#39;serviceName&#39; which can be controlled by users without any sanitization.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-6">March 15, 2020; 06:15:14 PM -04:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-critical" data-testid="vuln-cvss3-link-6" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2020-7606&amp;vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl07_Cvss3CalculatorAnchor">9.8 CRITICAL</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-danger" data-testid="vuln-cvss2-link-6" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2020-7606&amp;vector=(AV:N/AC:L/Au:N/C:P/I:P/A:P)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl07_Cvss2CalculatorAnchor">7.5 HIGH</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-7">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-7" href="https://nvd.nist.gov/vuln/detail/CVE-2019-12825">CVE-2019-12825</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-7">
							<span style="font-size:9px;">Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Docker registries of other groups. When a legitimate user changes the path of a group, Docker registries are not adapted, leaving them in the old namespace. They are not protected and are available to all other users with no previous access to the repo.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-7">February 17, 2020; 09:15:11 AM -05:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-warning" data-testid="vuln-cvss3-link-7" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2019-12825&amp;vector=AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl08_Cvss3CalculatorAnchor">4.3 MEDIUM</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-warning" data-testid="vuln-cvss2-link-7" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2019-12825&amp;vector=(AV:N/AC:L/Au:S/C:P/I:N/A:N)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl08_Cvss2CalculatorAnchor">4.0 MEDIUM</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-8">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-8" href="https://nvd.nist.gov/vuln/detail/CVE-2020-5239">CVE-2020-5239</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-8">
							<span style="font-size:9px;">In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-8">February 12, 2020; 08:15:11 PM -05:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-danger" data-testid="vuln-cvss3-link-8" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2020-5239&amp;vector=AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl09_Cvss3CalculatorAnchor">8.8 HIGH</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-warning" data-testid="vuln-cvss2-link-8" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2020-5239&amp;vector=(AV:N/AC:L/Au:S/C:P/I:P/A:P)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl09_Cvss2CalculatorAnchor">6.5 MEDIUM</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-9">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-9" href="https://nvd.nist.gov/vuln/detail/CVE-2020-8945">CVE-2020-8945</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-9">
							<span style="font-size:9px;">The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-9">February 12, 2020; 01:15:10 PM -05:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-critical" data-testid="vuln-cvss3-link-9" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2020-8945&amp;vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl10_Cvss3CalculatorAnchor">9.8 CRITICAL</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-danger" data-testid="vuln-cvss2-link-9" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2020-8945&amp;vector=(AV:N/AC:L/Au:N/C:P/I:P/A:P)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl10_Cvss2CalculatorAnchor">7.5 HIGH</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-10">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-10" href="https://nvd.nist.gov/vuln/detail/CVE-2019-19921">CVE-2019-19921</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-10">
							<span style="font-size:9px;">runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-10">February 12, 2020; 10:15:12 AM -05:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-danger" data-testid="vuln-cvss3-link-10" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2019-19921&amp;vector=AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl11_Cvss3CalculatorAnchor">7.0 HIGH</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-warning" data-testid="vuln-cvss2-link-10" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2019-19921&amp;vector=(AV:L/AC:M/Au:N/C:P/I:P/A:P)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl11_Cvss2CalculatorAnchor">4.4 MEDIUM</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-11">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-11" href="https://nvd.nist.gov/vuln/detail/CVE-2014-5278">CVE-2014-5278</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-11">
							<span style="font-size:9px;">A vulnerability exists in Docker before 1.2 via container names, which may collide with and override container IDs.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-11">February 07, 2020; 01:15:10 PM -05:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-warning" data-testid="vuln-cvss3-link-11" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2014-5278&amp;vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl12_Cvss3CalculatorAnchor">5.3 MEDIUM</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-warning" data-testid="vuln-cvss2-link-11" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2014-5278&amp;vector=(AV:N/AC:M/Au:N/C:N/I:P/A:N)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl12_Cvss2CalculatorAnchor">4.3 MEDIUM</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-12">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-12" href="https://nvd.nist.gov/vuln/detail/CVE-2019-3682">CVE-2019-3682</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-12">
							<span style="font-size:9px;">The docker-kubic package in SUSE CaaS Platform 3.0 before 17.09.1_ce-7.6.1 provided access to an insecure API locally on the Kubernetes master node.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-12">January 17, 2020; 04:15:10 AM -05:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-danger" data-testid="vuln-cvss3-link-12" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2019-3682&amp;vector=AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl13_Cvss3CalculatorAnchor">7.8 HIGH</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-warning" data-testid="vuln-cvss2-link-12" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2019-3682&amp;vector=(AV:L/AC:L/Au:N/C:P/I:P/A:P)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl13_Cvss2CalculatorAnchor">4.6 MEDIUM</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-13">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-13" href="https://nvd.nist.gov/vuln/detail/CVE-2019-14819">CVE-2019-14819</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-13">
							<span style="font-size:9px;">A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is assigned to the current namespace of the user performing the upgrade. This flaw can allow an unprivileged user to escalate their privileges to those allowed by the privileged Security Context Constraints.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-13">January 07, 2020; 01:15:10 PM -05:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-danger" data-testid="vuln-cvss3-link-13" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2019-14819&amp;vector=AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl14_Cvss3CalculatorAnchor">8.8 HIGH</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-warning" data-testid="vuln-cvss2-link-13" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2019-14819&amp;vector=(AV:N/AC:L/Au:S/C:P/I:P/A:P)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl14_Cvss2CalculatorAnchor">6.5 MEDIUM</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-14">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-14" href="https://nvd.nist.gov/vuln/detail/CVE-2014-0048">CVE-2014-0048</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-14">
							<span style="font-size:9px;">An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-14">January 02, 2020; 12:15:10 PM -05:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-critical" data-testid="vuln-cvss3-link-14" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2014-0048&amp;vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl15_Cvss3CalculatorAnchor">9.8 CRITICAL</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-danger" data-testid="vuln-cvss2-link-14" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2014-0048&amp;vector=(AV:N/AC:L/Au:N/C:P/I:P/A:P)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl15_Cvss2CalculatorAnchor">7.5 HIGH</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-15">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-15" href="https://nvd.nist.gov/vuln/detail/CVE-2014-8179">CVE-2014-8179</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-15">
							<span style="font-size:9px;">Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-15">December 17, 2019; 01:15:13 PM -05:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-danger" data-testid="vuln-cvss3-link-15" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2014-8179&amp;vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl16_Cvss3CalculatorAnchor">7.5 HIGH</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-warning" data-testid="vuln-cvss2-link-15" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2014-8179&amp;vector=(AV:N/AC:L/Au:N/C:N/I:P/A:N)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl16_Cvss2CalculatorAnchor">5.0 MEDIUM</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-16">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-16" href="https://nvd.nist.gov/vuln/detail/CVE-2014-8178">CVE-2014-8178</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-16">
							<span style="font-size:9px;">Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-16">December 17, 2019; 09:15:16 AM -05:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-warning" data-testid="vuln-cvss3-link-16" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2014-8178&amp;vector=AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl17_Cvss3CalculatorAnchor">5.5 MEDIUM</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-low" data-testid="vuln-cvss2-link-16" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2014-8178&amp;vector=(AV:L/AC:M/Au:N/C:N/I:P/A:N)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl17_Cvss2CalculatorAnchor">1.9 LOW</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-17">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-17" href="https://nvd.nist.gov/vuln/detail/CVE-2014-9356">CVE-2014-9356</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-17">
							<span style="font-size:9px;">Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-17">December 02, 2019; 01:15:10 PM -05:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-danger" data-testid="vuln-cvss3-link-17" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2014-9356&amp;vector=AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl18_Cvss3CalculatorAnchor">8.6 HIGH</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-danger" data-testid="vuln-cvss2-link-17" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2014-9356&amp;vector=(AV:N/AC:L/Au:N/C:N/I:C/A:P)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl18_Cvss2CalculatorAnchor">8.5 HIGH</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-18">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-18" href="https://nvd.nist.gov/vuln/detail/CVE-2019-16884">CVE-2019-16884</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-18">
							<span style="font-size:9px;">runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-18">September 25, 2019; 02:15:13 PM -04:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.1:</em> <a class="label label-danger" data-testid="vuln-cvss3-link-18" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2019-16884&amp;vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N&amp;version=3.1" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl19_Cvss3CalculatorAnchor">7.5 HIGH</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-warning" data-testid="vuln-cvss2-link-18" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2019-16884&amp;vector=(AV:N/AC:L/Au:N/C:N/I:P/A:N)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl19_Cvss2CalculatorAnchor">5.0 MEDIUM</a> </span></span></td>
				</tr>
				<tr data-testid="vuln-row-19">
					<th nowrap="nowrap">
						<span style="font-size:9px;"><strong><a data-testid="vuln-detail-link-19" href="https://nvd.nist.gov/vuln/detail/CVE-2019-15752">CVE-2019-15752</a></strong></span></th>
					<td>
						<p data-testid="vuln-summary-19">
							<span style="font-size:9px;">Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run &#39;docker login&#39; to force the command.</span></p>
						<span style="font-size:9px;"><strong>Published:</strong> <span data-testid="vuln-published-on-19">August 28, 2019; 05:15:10 PM -04:00</span></span></td>
					<td nowrap="nowrap">
						<span style="font-size:9px;"><span><em>V3.0:</em> <a class="label label-danger" data-testid="vuln-cvss3-link-19" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2019-15752&amp;vector=AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H&amp;version=3.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl20_Cvss3CalculatorAnchor">7.8 HIGH</a></span><br />
						<span><em>&nbsp;&nbsp;&nbsp;&nbsp;V2:</em> <a class="label label-danger" data-testid="vuln-cvss2-link-19" href="https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2019-15752&amp;vector=(AV:N/AC:M/Au:N/C:C/I:C/A:C)&amp;version=2.0" id="p_lt_WebPartZone1_zoneCenter_pageplaceholder_p_lt_WebPartZone1_zoneCenter_VulnerabilitySearchResults_VulnResultsRepeater_ctl20_Cvss2CalculatorAnchor">9.3 HIGH</a> </span></span></td>
				</tr>
			</tbody>
		</table>


###### Source: National Vulnerability Database (NVD – USA) lists various vulnerability related to docker or popular images of docker in its hub: https://nvd.nist.gov/vuln/search/results?form_type=basic&results_type=overview&search_type=all&query=docker&startIndex=20

#***Solutions?***

**(a)Choosing another container technology: lxc/podman**
**(b) Running docker in daemon-less + rootless containers like lxc/podman**
**(c)If you can’t switch to another technology then make your docker more secure.**
Refer to this article:
{% link https://dev.to/manishfoodtechs/rootless-docker-kick-docker-hackers-and-make-docker-more-secure-new-concept-70g %}

I hope you people like the above article and learned something.
######***IMP REQUEST:***
###### You are most welcome to join my team [ form for joining ](https://forms.gle/pSCALuEWHus3pg9F6).
###### *Also you are most welcome to join OPEN SOURCE INTELLIGENT SYSTEM (OSINT)if you can help in open source project regarding safeguarding humans from various diseases like CORONA outbreak*
######https://github.com/Manishfoodtechs/OSINTHRH/wiki


Contact email: Manishfoodtechs@gmail.com. 

If you have any problem, our team is also engaged in professional consultancy and delivery.




![](https://logos.flamingtext.com/Name-Logos/Followme-design-stripes-name.gif)