mirror of
https://github.com/moby/moby.git
synced 2026-06-24 08:48:23 +00:00
c3967c40c0
This release include 3 security fixes following the security policy:
- mime: quadratic complexity in WordDecoder.DecodeHeader
Decoding a maliciously-crafted MIME header containing many invalid
encoded-words could consume excessive CPU.
The MIME decoder now better handles this case.
Thanks to p4p3r (https://hackerone.com/p4p3r_hak) for reporting this issue.
This is CVE-2026-42504 and Go issue https://go.dev/issue/79217.
- net/textproto: arbitrary input are included in errors without any escaping
When returning errors, functions in the net/textproto package would
include its input as part of the error, without any escaping. Note that
said input is often controlled by external parties when using this
package naturally. For example, a net/http client uses ReadMIMEHeader
when parsing the headers it receive from a server.
As a result, an attacker could inject arbitrary content into the error.
Practically, this can result in an attacker injecting misleading
content, terminal control bytes, etc. into a victim's output or logs.
This is CVE-2026-42507 and Go issue https://go.dev/issue/79346
- crypto/x509: split candidate hostname only once
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop
over all DNS Subject Alternative Name (SAN) entries. This caused
strings.Split(host, ".") to execute repeatedly on the same input hostname.
With a large DNS SAN list, verification costs scaled quadratically based on the
number of SAN entries multiplied by the hostname's label count. Because
x509.Verify validates hostnames before building the certificate chain, this
overhead occurred even for untrusted certificates.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-27145 and https://go.dev/issue/79694.
View the release notes for more information:
https://go.dev/doc/devel/release#go1.26.4
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
62 lines
1.9 KiB
Docker
62 lines
1.9 KiB
Docker
# docker build -t docker:simple -f Dockerfile.simple .
|
|
# docker run --rm docker:simple hack/make.sh dynbinary
|
|
# docker run --rm --privileged docker:simple hack/dind hack/make.sh test-unit
|
|
# docker run --rm --privileged -v /var/lib/docker docker:simple hack/dind hack/make.sh dynbinary test-integration
|
|
|
|
# This represents the bare minimum required to build and test Docker.
|
|
|
|
ARG GO_VERSION=1.26.4
|
|
|
|
ARG BASE_DEBIAN_DISTRO="bookworm"
|
|
ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}"
|
|
|
|
FROM ${GOLANG_IMAGE}
|
|
ENV GOTOOLCHAIN=local
|
|
|
|
# Compile and runtime deps
|
|
# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#build-dependencies
|
|
# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
build-essential \
|
|
curl \
|
|
cmake \
|
|
git \
|
|
libseccomp-dev \
|
|
ca-certificates \
|
|
e2fsprogs \
|
|
iptables \
|
|
pkg-config \
|
|
pigz \
|
|
procps \
|
|
xfsprogs \
|
|
xz-utils \
|
|
\
|
|
vim-common \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install containerd.io (includes runc), tini, and docker-ce-cli.
|
|
# The versions of these dependencies differ from the main Dockerfile,
|
|
# but it should be sufficient for minimal build and test purposes.
|
|
ADD --chmod=0644 --checksum=sha256:1500c1f56fa9e26b9b8f42452a553675796ade0807cdce11975eb98170b3a570 \
|
|
https://download.docker.com/linux/debian/gpg /etc/apt/keyrings/docker.asc
|
|
ARG BASE_DEBIAN_DISTRO
|
|
ADD <<-EOT /etc/apt/sources.list.d/docker.sources
|
|
Types: deb
|
|
URIs: https://download.docker.com/linux/debian
|
|
Suites: ${BASE_DEBIAN_DISTRO}
|
|
Components: stable
|
|
Signed-By: /etc/apt/keyrings/docker.asc
|
|
EOT
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
containerd.io \
|
|
tini \
|
|
docker-ce-cli \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& ln -s /usr/bin/tini-static /usr/local/bin/docker-init
|
|
|
|
ENV PATH=/usr/local/cli:$PATH
|
|
|
|
ENV AUTO_GOPATH 1
|
|
WORKDIR /usr/src/docker
|
|
COPY . /usr/src/docker
|