docsCreated with Sketch.

Docker Engine 19.03 release notes

19.03.15

2021-02-01

Security

  • CVE-2021-21285open_in_new Prevent an invalid image from crashing docker daemon
  • CVE-2021-21284open_in_new Lock down file permissions to prevent remapped root from accessing docker state
  • Ensure AppArmor and SELinux profiles are applied when building with BuildKit

Client

  • Check contexts before importing them to reduce risk of extracted files escaping context store

19.03.14

2020-12-01

Security

Builder

Networking

Runtime

Rootless

Logging

19.03.13

2020-09-16

Builder

Client

Networking

Rootless

Runtime

Windows

19.03.12

2020-06-18

Client

Networking

Runtime

19.03.11

2020-06-01

Network

Disable IPv6 Router Advertisements to prevent address spoofing. CVE-2020-13401open_in_new

Description

In the Docker default configuration, the container network interface is a virtual ethernet link going to the host (veth interface). In this configuration, an attacker able to run a process as root in a container can send and receive arbitrary packets to the host using the CAP_NET_RAW capability (present in the default configuration).

If IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it’s pretty likely that ipv6 forwarding is disabled, that is, /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configures the IPv6 stack using them.

By sending “rogue” router advertisements from a container, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker-controlled container.

Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond. If by chance the host has a vulnerability like last year’s RCE in apt (CVE-2019-3462), the attacker can now escalate to the host.

As CAP_NET_ADMIN is not present by default for Docker containers, the attacker can’t configure the IPs they want to MitM, they can’t use iptables to NAT or REDIRECT the traffic, and they can’t use IP_TRANSPARENT. The attacker can however still use CAP_NET_RAW and implement a tcp/ip stack in user space.

See kubernetes/kubernetes#91507open_in_new for related issues.

19.03.10

2020-05-29

Client

Networking

Runtime

Packaging

19.03.9

2020-05-14

Builder

Client

Logging

Networking

Runtime

Rootless

Security

Swarm

19.03.8

2020-03-10

Runtime

19.03.7

2020-03-03

Builder

Runtime

Client

19.03.6

2020-02-12

Builder

Networking

Runtime

19.03.5

2019-11-14

Builder

Packaging

  • Support RHEL 8 packages

Runtime

19.03.4

2019-10-17

Networking

Known Issues

Existing

  • In some circumstances with large clusters, Docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.
  • Orchestrator port conflict can occur when redeploying all services as new. Due to many Swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.
    • Workaround: restart all tasks via docker service update --force.
  • CVE-2018-15664open_in_new symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252open_in_new
  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.

19.03.3

2019-10-08

Security

Builder

Client

Runtime

Known Issues

New

  • DOCKER-USER iptables chain is missing: docker/for-linux#810open_in_new. Users cannot perform additional container network traffic filtering on top of this iptables chain. You are not affected by this issue if you are not customizing iptable chains on top of DOCKER-USER.
    • Workaround: Insert the iptables chain after the docker daemon starts. For example:
      iptables -N DOCKER-USER
iptables -I FORWARD -j DOCKER-USER
iptables -A DOCKER-USER -j RETURN

Existing

  • In some circumstances with large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.
  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.
    • Workaround: restart all tasks via docker service update --force.
  • CVE-2018-15664open_in_new symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252open_in_new
  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.

19.03.2

2019-09-03

Builder

Client

Logging

Networking

Runtime

Swarm

Known issues

  • In some circumstances with large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.

  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.

    • Workaround: restart all tasks via docker service update --force.

  • Traffic cannot egress the HOST because of missing Iptables rules in the FORWARD chain The missing rules are :

    /sbin/iptables --wait -C FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables --wait -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    • Workaround: Add these rules back using a script and cron definitions. The script must contain '-C' commands to check for the presence of a rule and '-A' commands to add rules back. Run the script on a cron in regular intervals, for example, every minutes.
    • Affected versions: 18.09.1, 19.03.0

  • CVE-2018-15664open_in_new symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252open_in_new

  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.

19.03.1

2019-07-25

Security

Known issues

  • In some circumstances, in large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.

  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.

    • Workaround: restart all tasks via docker service update --force.

  • Traffic cannot egress the HOST because of missing Iptables rules in the FORWARD chain The missing rules are :

    /sbin/iptables --wait -C FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables --wait -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    • Workaround: Add these rules back using a script and cron definitions. The script must contain '-C' commands to check for the presence of a rule and '-A' commands to add rules back. Run the script on a cron in regular intervals, for example, every minutes.
    • Affected versions: 18.09.1, 19.03.0

  • CVE-2018-15664open_in_new symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252open_in_new

  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.

19.03.0

2019-07-22

Builder

Client

API

Experimental

Security

Runtime

Networking

Swarm

Logging

Deprecation

For more information on deprecated flags and APIs, refer to deprecation information for target removal dates.

Known issues

  • In some circumstances with large clusters, docker information might, as part of the Swarm section, include the error code = ResourceExhausted desc = grpc: received message larger than max (5351376 vs. 4194304). This does not indicate any failure or misconfiguration by the user, and requires no response.

  • Orchestrator port conflict can occur when redeploying all services as new. Due to many swarm manager requests in a short amount of time, some services are not able to receive traffic and are causing a 404 error after being deployed.

    • Workaround: restart all tasks via docker service update --force.

  • Traffic cannot egress the HOST because of missing Iptables rules in the FORWARD chain The missing rules are :

    /sbin/iptables --wait -C FORWARD -o docker_gwbridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables --wait -C FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    • Workaround: Add these rules back using a script and cron definitions. The script must contain '-C' commands to check for the presence of a rule and '-A' commands to add rules back. Run the script on a cron in regular intervals, for example, every minutes.
    • Affected versions: 18.09.1, 19.03.0

  • CVE-2018-15664open_in_new symlink-exchange attack with directory traversal. Workaround until proper fix is available in upcoming patch release: docker pause container before doing file operations. moby/moby#39252open_in_new

  • docker cp regression due to CVE mitigation. An error is produced when the source of docker cp is set to /.