Описание
Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the Docker archive API.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| zabbix | fixed | 1:7.0.27+dfsg-1 | package | |
| zabbix | no-dsa | trixie | package | |
| zabbix | no-dsa | bookworm | package |
Примечания
https://support.zabbix.com/browse/ZBX-27642
Fixed by: https://github.com/zabbix/zabbix/commit/fd652da1fc528d05c7c18dd1e009c20397237f77 (master)
EPSS
Связанные уязвимости
Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the Docker archive API.
Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the Docker archive API.
EPSS