SB2025040388 - SUSE update for docker, docker-stable 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025040388

SB2025040388 - SUSE update for docker, docker-stable

Published: April 3, 2025

Security Bulletin ID SB2025040388
Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 60% Low 40%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2024-2365)

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due to software uses a weak SHA-1 Message_Digest algorithm within the IsValidPin() function in io\fabric\sdk\android\services\network\PinningTrustManager.java. An attacker with physical access to the system can bypass SSL pinning protection and intercept traffic sent by the application.


2) Incorrect Resource Transfer Between Spheres (CVE-ID: CVE-2024-29018)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application within external DNS requests from "internal" networks. A remote attacker can gain unauthorized access to sensitive information on the system.


3) Incorrect authorization (CVE-ID: CVE-2024-41110)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to AuthZ zero length regression. A remote user can bypass authentication and gain elevated privileges.


4) Resource exhaustion (CVE-ID: CVE-2025-22868)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the jws package does not properly control consumption of internal resources when handling malformed tokens. A remote attacker can pass a malformed JWT token to the application, trigger resource exhaustion and perform a denial of service (DoS) attack.


5) Resource exhaustion (CVE-ID: CVE-2025-22869)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the ssh package when handling clients that complete the key exchange slowly, or not at all. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References