CVE-2018-12608

—

CVSS 3.0

7.5 high

EPSS

<1%p58

Published

Sep 10, 2018 (Sep 10, 2018)

Modified

Jun 17, 2026

Description

An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA (as opposed to one signed by the configured CA root certificate) to authenticate.

Vendors: mobyproject
Products: moby
Weakness: CWE-295
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.