Skip to content
Fencer Vulns
high 7.5

CVE-2018-12608 json

Docker Authentication Bypass

published 2018-09-10 8 y ago modified 2026-09-10 1 mo ago also GHSA-qrqr-3x5j-2xw9 , EUVD-2024-0408

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits
0
none known

Summary

An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA (as opposed to one signed by the configured CA root certificate) to authenticate.

Patch / fix

  • go github.com/docker/docker 17.06.0-ce
  • mobyproject moby 17.06.0
  • docker.io Debian 14, Debian 13, Debian 12 18.03.1+dfsg1-2

debian advisories DEBIAN-CVE-2018-12608

  • docker.io Ubuntu 16.04 LTS 18.06.1-0ubuntu1~16.04.2
  • docker.io Ubuntu 18.04 LTS 18.06.1-0ubuntu1~18.04.1

ubuntu advisories UBUNTU-CVE-2018-12608

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-12608 updated cvss 7.5

moby: cert signing bypass

  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/proxyv2-rhel8
    affected: workaround, no fix planned “Some environments may be able to mitigate this issue by removing extra CAs from the host.”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-agent-installer-api-server-rhel9
    affected: workaround, no fix available, no fix planned “Some environments may be able to mitigate this issue by removing extra CAs from the host.”
  • Red Hat RHOSSM 2.6 for RHEL 8 openshift-service-mesh/kiali-rhel8 1.73.9-2, openshift-service-mesh/pilot-rhel8 2.6.0-19, openshift-service-mesh/grafana-rhel8 2.6.0-7, openshift-service-mesh/ratelimit-rhel8 2.6.0-8, openshift-service-mesh/istio-cni-rhel8 2.6.0-21, openshift-service-mesh/kiali-ossmc-rhel8 1.73.10-3, +3 more Red Hat RHOSSM 2.6 for RHEL 9 openshift-service-mesh/proxyv2-rhel9 2.6.0-18
    fixed: vendor fix “Some environments may be able to mitigate this issue by removing extra CAs from the host.” RHSA-2024:5094
  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/agent-service-rhel8 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Ceph Storage 6 rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 7 rhceph/grafana-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.92% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N
GitHub 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/docker/docker
<17.06.0-ce
17.06.0-ce

Classification

Weakness
  • CWE-295 Improper Certificate Validation
  • CWE-288 Authentication Bypass Using an Alternate Path or Channel
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.