CVE-2024-41110

A vulnerability was found in Authorization plugins in Docker Engine (AuthZ). Using a specially-crafted API request, an Engine API client could make the daemon forward a request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request that it would have otherwise denied if the body had been forwarded to it.

This flaw is a regression of a fix from a 2019 issue for this same scenario, which was not carried forward. Anyone who depends on authorization plugins that introspect the request or response body to make access control decisions may be impacted.

Red Hat does not ship AuthZ plugin in any of the current container tools such as Podman, Buildah, Skopeo, and containernetworking-plugins, therefore, they are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.