| id: GO-2023-1700 |
| modules: |
| - module: github.com/docker/docker |
| versions: |
| - introduced: 1.12.0 |
| - fixed: 20.10.24+incompatible |
| - introduced: 23.0.0+incompatible |
| - fixed: 23.0.3+incompatible |
| vulnerable_at: 23.0.2+incompatible |
| summary: Docker Swarm encrypted overlay network traffic may be unencrypted in github.com/docker/docker |
| cves: |
| - CVE-2023-28841 |
| ghsas: |
| - GHSA-33pg-m6jh-5237 |
| references: |
| - advisory: https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237 |
| - advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-28841 |
| - web: https://github.com/moby/libnetwork/blob/d9fae4c73daf76c3b0f77e14b45b8bf612ba764d/drivers/overlay/encryption.go#L205-L207 |
| - web: https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333 |
| - web: https://github.com/moby/moby/issues/43382 |
| - web: https://github.com/moby/moby/pull/45118 |
| - web: https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp |
| - web: https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p |
| - web: https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw |
| source: |
| id: GHSA-33pg-m6jh-5237 |
| created: 2024-08-20T11:40:20.897365-04:00 |
| review_status: UNREVIEWED |
| unexcluded: EFFECTIVELY_PRIVATE |
