Security update for docker

Announcement ID:	SUSE-SU-2024:4360-1
Release Date:	2024-12-17T14:36:29Z
Rating:	important
References:	bsc#1217070 bsc#1228324 bsc#1228553 bsc#1229806 bsc#1230294 bsc#1230331 bsc#1230333 bsc#1231348 bsc#1232999 bsc#1233819
Cross-References:	CVE-2023-45142 CVE-2023-47108 CVE-2024-41110
CVSS scores:	CVE-2023-45142 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-45142 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-47108 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-47108 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2024-41110 ( SUSE ): 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products:	Containers Module 15-SP5 Containers Module 15-SP6 openSUSE Leap 15.5 openSUSE Leap 15.6 openSUSE Leap Micro 5.5 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15 SP2 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS SUSE Linux Enterprise High Performance Computing 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP4 SUSE Linux Enterprise High Performance Computing 15 SP5 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro 5.5 SUSE Linux Enterprise Micro for Rancher 5.2 SUSE Linux Enterprise Micro for Rancher 5.3 SUSE Linux Enterprise Micro for Rancher 5.4 SUSE Linux Enterprise Real Time 15 SP5 SUSE Linux Enterprise Real Time 15 SP6 SUSE Linux Enterprise Server 15 SP2 SUSE Linux Enterprise Server 15 SP2 LTSS SUSE Linux Enterprise Server 15 SP3 SUSE Linux Enterprise Server 15 SP3 LTSS SUSE Linux Enterprise Server 15 SP4 SUSE Linux Enterprise Server 15 SP4 LTSS SUSE Linux Enterprise Server 15 SP5 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP6

An update that solves three vulnerabilities and has seven security fixes can now be installed.

Description:

This update for docker fixes the following issues:

• Update docker-buildx to v0.19.2. See upstream changelog online at <https://github.com/docker/buildx/releases/tag/v0.19.2>.

Some notable changelogs from the last update: * <https://github.com/docker/buildx/releases/tag/v0.19.0> * <https://github.com/docker/buildx/releases/tag/v0.18.0>

• Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999

In order to disable these mounts, just do

echo 0 > /etc/docker/suse-secrets-enable

and restart Docker. In order to re-enable them, just do

echo 1 > /etc/docker/suse-secrets-enable

and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not.

• Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819

• Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases.

• Allow a parallel docker-stable RPM to exists in repositories.

• Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at <https://github.com/docker/buildx/releases/tag/v0.17.1>

• Allow users to disable SUSE secrets support by setting DOCKER_SUSE_SECRETS_ENABLE=0 in /etc/sysconfig/docker. (bsc#1231348)

• Mark docker-buildx as required since classic "docker build" has been deprecated since Docker 23.0. (bsc#1230331)

• Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate package, but with docker-stable it will be necessary to maintain the packages together and it makes more sense to have them live in the same OBS package. (bsc#1230333)

• Update to Docker 26.1.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.1/#2615> bsc#1230294

• This update includes fixes for:

• CVE-2024-41110. bsc#1228324
• CVE-2023-47108. bsc#1217070 bsc#1229806

• CVE-2023-45142. bsc#1228553 bsc#1229806

• Update to Docker 26.1.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.1/#2614>

• Update to Docker 26.1.0-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.1/#2610>

• Update --add-runtime to point to correct binary path.

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• openSUSE Leap Micro 5.5
  zypper in -t patch openSUSE-Leap-Micro-5.5-2024-4360=1
• openSUSE Leap 15.5
  zypper in -t patch openSUSE-SLE-15.5-2024-4360=1
• openSUSE Leap 15.6
  zypper in -t patch openSUSE-SLE-15.6-2024-4360=1
• SUSE Linux Enterprise Micro for Rancher 5.3
  zypper in -t patch SUSE-SLE-Micro-5.3-2024-4360=1
• SUSE Linux Enterprise Micro 5.3
  zypper in -t patch SUSE-SLE-Micro-5.3-2024-4360=1
• SUSE Linux Enterprise Micro for Rancher 5.4
  zypper in -t patch SUSE-SLE-Micro-5.4-2024-4360=1
• SUSE Linux Enterprise Micro 5.4
  zypper in -t patch SUSE-SLE-Micro-5.4-2024-4360=1
• SUSE Linux Enterprise Micro 5.5
  zypper in -t patch SUSE-SLE-Micro-5.5-2024-4360=1
• Containers Module 15-SP5
  zypper in -t patch SUSE-SLE-Module-Containers-15-SP5-2024-4360=1
• Containers Module 15-SP6
  zypper in -t patch SUSE-SLE-Module-Containers-15-SP6-2024-4360=1
• SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
  zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-4360=1
• SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
  zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-4360=1
• SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
  zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-4360=1
• SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
  zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-4360=1
• SUSE Linux Enterprise Server 15 SP2 LTSS
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-4360=1
• SUSE Linux Enterprise Server 15 SP3 LTSS
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-4360=1
• SUSE Linux Enterprise Server 15 SP4 LTSS
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-4360=1
• SUSE Linux Enterprise Server for SAP Applications 15 SP2
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-4360=1
• SUSE Linux Enterprise Server for SAP Applications 15 SP3
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-4360=1
• SUSE Linux Enterprise Server for SAP Applications 15 SP4
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-4360=1
• SUSE Enterprise Storage 7.1
  zypper in -t patch SUSE-Storage-7.1-2024-4360=1
• SUSE Linux Enterprise Micro 5.1
  zypper in -t patch SUSE-SUSE-MicroOS-5.1-2024-4360=1
• SUSE Linux Enterprise Micro 5.2
  zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-4360=1
• SUSE Linux Enterprise Micro for Rancher 5.2
  zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-4360=1

Package List:

• openSUSE Leap Micro 5.5 (aarch64 s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• openSUSE Leap 15.5 (noarch)
  • docker-rootless-extras-26.1.5_ce-150000.212.1
  • docker-fish-completion-26.1.5_ce-150000.212.1
  • docker-bash-completion-26.1.5_ce-150000.212.1
  • docker-zsh-completion-26.1.5_ce-150000.212.1
• openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• openSUSE Leap 15.6 (noarch)
  • docker-rootless-extras-26.1.5_ce-150000.212.1
  • docker-fish-completion-26.1.5_ce-150000.212.1
  • docker-bash-completion-26.1.5_ce-150000.212.1
  • docker-zsh-completion-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• Containers Module 15-SP5 (aarch64 ppc64le s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• Containers Module 15-SP5 (noarch)
  • docker-rootless-extras-26.1.5_ce-150000.212.1
  • docker-bash-completion-26.1.5_ce-150000.212.1
• Containers Module 15-SP6 (aarch64 ppc64le s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• Containers Module 15-SP6 (noarch)
  • docker-rootless-extras-26.1.5_ce-150000.212.1
  • docker-bash-completion-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS (aarch64 x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS (noarch)
  • docker-bash-completion-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch)
  • docker-fish-completion-26.1.5_ce-150000.212.1
  • docker-bash-completion-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)
  • docker-rootless-extras-26.1.5_ce-150000.212.1
  • docker-bash-completion-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch)
  • docker-rootless-extras-26.1.5_ce-150000.212.1
  • docker-bash-completion-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Server 15 SP2 LTSS (aarch64 ppc64le s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Server 15 SP2 LTSS (noarch)
  • docker-bash-completion-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Server 15 SP3 LTSS (aarch64 ppc64le s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Server 15 SP3 LTSS (noarch)
  • docker-fish-completion-26.1.5_ce-150000.212.1
  • docker-bash-completion-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Server 15 SP4 LTSS (noarch)
  • docker-rootless-extras-26.1.5_ce-150000.212.1
  • docker-bash-completion-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch)
  • docker-bash-completion-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch)
  • docker-fish-completion-26.1.5_ce-150000.212.1
  • docker-bash-completion-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)
  • docker-rootless-extras-26.1.5_ce-150000.212.1
  • docker-bash-completion-26.1.5_ce-150000.212.1
• SUSE Enterprise Storage 7.1 (aarch64 x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Enterprise Storage 7.1 (noarch)
  • docker-fish-completion-26.1.5_ce-150000.212.1
  • docker-bash-completion-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1
• SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64)
  • docker-26.1.5_ce-150000.212.1
  • docker-debuginfo-26.1.5_ce-150000.212.1

References:

• https://www.suse.com/security/cve/CVE-2023-45142.html
• https://www.suse.com/security/cve/CVE-2023-47108.html
• https://www.suse.com/security/cve/CVE-2024-41110.html
• https://bugzilla.suse.com/show_bug.cgi?id=1217070
• https://bugzilla.suse.com/show_bug.cgi?id=1228324
• https://bugzilla.suse.com/show_bug.cgi?id=1228553
• https://bugzilla.suse.com/show_bug.cgi?id=1229806
• https://bugzilla.suse.com/show_bug.cgi?id=1230294
• https://bugzilla.suse.com/show_bug.cgi?id=1230331
• https://bugzilla.suse.com/show_bug.cgi?id=1230333
• https://bugzilla.suse.com/show_bug.cgi?id=1231348
• https://bugzilla.suse.com/show_bug.cgi?id=1232999
• https://bugzilla.suse.com/show_bug.cgi?id=1233819