Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.
CVSS Details
- CVSS 3.1 Base Score: 2.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade docker | Aug 22, 2024 | Oct 4, 2021 |
| Amazon Linux Ami 2 | — | Upgrade dockerUpgrade docker-debuginfo | Jul 4, 2022 | Oct 4, 2021 |
| Amazon_linux | — | Upgrade docker | May 13, 2025 | Oct 4, 2021 |
| Debian | — | Upgrade docker.io | Jul 30, 2024 | Oct 4, 2021 |
| Gentoo Linux | — | Upgrade app-containers/docker. | Sep 30, 2024 | Oct 4, 2021 |
| Huawei Euleros 2_0_sp10 | — | Upgrade docker-engine | Aug 18, 2022 | Oct 4, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade docker-engine | Aug 18, 2022 | Oct 4, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade docker-engine | Aug 18, 2022 | Oct 4, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade docker-engine | Sep 14, 2022 | Oct 4, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 4, 2021 |
| Suse | — | Upgrade docker-kubic-zsh-completionUpgrade docker-bash-completionUpgrade docker-kubic-kubeadm-criconfigUpgrade containerdUpgrade containerd-ctrUpgrade docker-zsh-completionUpgrade docker-kubicUpgrade dockerUpgrade docker-fish-completionUpgrade docker-kubic-bash-completionUpgrade docker-kubic-fish-completionUpgrade runc | Oct 26, 2021 | Oct 4, 2021 |
| Ubuntu | — | Upgrade docker.io (Ubuntu Pro)Upgrade docker.io | Mar 25, 2022 | Oct 4, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 4, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub