UpHeron
All vulnerabilities

Servers and applications

CVE-2022-36109

Security vulnerability relating to supplementary group permissions

Severity
Medium 6.3
Published
9 Sept 2022
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
20.10.18
Also known as
GHSA-rc4r-wh2q-q6c4
Sources
NVD, Project advisories (GitHub)

Description

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining…

Affected software

SoftwareAffected versions
Docker EngineServers and applications · cpe:a:mobyproject:moby
  • Every version before 20.10.18
Docker EngineServers and applications · github:moby/moby
  • Every version before 20.10.18

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-36109
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-36109
  • GitHub Advisory Database https://github.com/advisories/GHSA-rc4r-wh2q-q6c4
  • github.com https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4