x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-xmmx-7jpf-fx42

[GoVulnBot]

In GitHub Security Advisory GHSA-xmmx-7jpf-fx42, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/docker/docker	20.10.11	< 20.10.11

Cross references:

• Module github.com/docker/docker appears in issue x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-44gg-pmqr-4669 #625 NOT_IMPORTABLE
• Module github.com/docker/docker appears in issue x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-5qgp-p5jc-w2rm #630 NOT_IMPORTABLE
• Module github.com/docker/docker appears in issue x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-8w94-cf6g-c8mg #636 NOT_IMPORTABLE
• Module github.com/docker/docker appears in issue x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-997c-fj8j-rq5h #640 NOT_IMPORTABLE
• Module github.com/docker/docker appears in issue x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-g44j-7vp3-68cv #647 NOT_IMPORTABLE
• Module github.com/docker/docker appears in issue x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-g7v2-2qxx-wjrw #649 NOT_IMPORTABLE
• Module github.com/docker/docker appears in issue x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-qmmc-jppf-32wv #705 NOT_IMPORTABLE
• Module github.com/docker/docker appears in issue x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-wxj3-qwv4-cvfm #752 NOT_IMPORTABLE
• Module github.com/docker/docker appears in issue x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-j249-ghv5-7mxv #2013 NOT_IMPORTABLE
• Module github.com/docker/docker appears in issue x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-jq35-85cj-fj4p #2161 NOT_IMPORTABLE
• Module github.com/docker/docker appears in issue x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-mq39-4gv4-mvpx #2659
• Module github.com/docker/docker appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2024-32473 #2737

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/docker/docker
      versions:
        - fixed: 20.10.11+incompatible
      vulnerable_at: 20.10.10+incompatible
      packages:
        - package: github.com/docker/docker
summary: Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing in github.com/docker/docker
ghsas:
    - GHSA-xmmx-7jpf-fx42
references:
    - advisory: https://github.com/advisories/GHSA-xmmx-7jpf-fx42
    - advisory: https://github.com/moby/moby/security/advisories/GHSA-xmmx-7jpf-fx42
source:
    id: GHSA-xmmx-7jpf-fx42
    created: 2024-06-10T20:01:59.195913616Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/592456 mentions this issue: data/reports: add 19 unreviewed reports

[gopherbot]

Change https://go.dev/cl/592457 mentions this issue: data/reports: add 16 unreviewed reports

[gopherbot]

Change https://go.dev/cl/595999 mentions this issue: data/reports: review 7 reports