docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

scout: add CVE-2024-3094 to high-profile vulns 

Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
This commit is contained in:
David Karlsson 2024-04-02 11:52:08 +02:00
parent 85688fa3e5
commit 4f3de2e5d6
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
content/scout/policy/_index.md
View File

@ -135,6 +135,7 @@ The list includes the following vulnerabilities:
- [CVE-2021-44228 (Log4Shell)](https://scout.docker.com/v/CVE-2021-44228)
- [CVE-2023-38545 (cURL SOCKS5 heap buffer overflow)](https://scout.docker.com/v/CVE-2023-38545)
- [CVE-2023-44487 (HTTP/2 Rapid Reset)](https://scout.docker.com/v/CVE-2023-44487)
- [CVE-2024-3094 (XZ backdoor)](https://scout.docker.com/v/CVE-2024-3094)
You can configure the CVEs included in this list by creating a custom policy.
For more information, see [Configure policies](./configure.md).

8
content/scout/release-notes/platform.md
View File

@ -18,6 +18,14 @@ for what's coming next.
New features and enhancements released in the first quarter of 2024.
### 2024-03-29
The **High-profile vulnerabilities** policy now reports the `xz` backdoor
vulnerability [CVE-2024-3094](https://scout.docker.com/v/CVE-2024-3094). Any
images in your Docker organization containing the version of `xz/liblzma` with
the backdoor will be non-compliant with the **High-profile vulnerabilities**
policy.
### 2024-03-20
The **Fixable critical and high vulnerabilities** policy now supports a