SB2023081442 - SUSE update for docker

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Unprotected Alternate Channel (CVE-ID: CVE-2023-28840)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to unprotected alternate channel within encrypted overlay networks. A remote attacker can inject arbitrary Ethernet frames into the encrypted overlay network and perform a denial of service (DoS) attack.

2) Missing Encryption of Sensitive Data (CVE-ID: CVE-2023-28841)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to missing encryption of sensitive data within the overlay network driver. A remote attacker can gain unauthorized access to sensitive information on the system.

3) Unprotected Alternate Channel (CVE-ID: CVE-2023-28842)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to unprotected alternate channel within encrypted overlay networks. A remote attacker can inject arbitrary Ethernet frames into the encrypted overlay network by encapsulating them in VXLAN datagrams.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2023/suse-su-20233307-1/