Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access
概要
Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s agent-backed shell endpoints allows a user restricted by label filters (for example, label=env=dev) to obtain an interactive root shell in out‑of‑scope containers (for example, env=prod) on the same agent host by directly targeting their container IDs. Version 9.0.3 contains a patch for the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com