cve.bz

CVE-2021-41089

6.3 mediumEPSS 0.3%

Medium (6.3). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/docker/docker 20.10.9, 20.10.9+incompatible.

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.

Severity

CVSS 3.1

6.3 medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
EPSS
0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE
CWE-281
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-v994-f8vw-g7j4Gogithub.com/docker/docker<20.10.920.10.9
GO-2024-2913Gogithub.com/docker/docker<20.10.9+incompatible20.10.9+incompatible
GO-2024-2913Gogithub.com/moby/moby<20.10.9+incompatible20.10.9+incompatible

References

Check your stackJSON