CVE catalog

CVE-2021-41089

docker.io: CVE-2021-41089

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.29% · Oct 25, 2026

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandocker.iosid28.5.2+dfsg4-5fixed
Debiandocker.ioforky28.5.2+dfsg4-5fixed
Debiandocker.iotrixie26.1.5+dfsg1-9+deb13u1fixed
Debiandocker.iotrixie-security26.1.5+dfsg1-9+deb13u1fixed
Debiandocker.iobookworm20.10.24+dfsg1-1+deb12u1fixed
Ubuntudocker.iopro1.6.2~dfsg1-1ubuntu4vulnerable
Ubuntudocker.iopro1.10.2-0ubuntu3vulnerable
Ubuntudocker.iopro1.10.2-0ubuntu4vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu1vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu4vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu5vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu6vulnerable
Ubuntudocker.iopro1.11.2-0ubuntu5~16.04vulnerable
Ubuntudocker.iopro1.12.1-0ubuntu13~16.04.1vulnerable
Ubuntudocker.iopro1.12.3-0ubuntu4~16.04.2vulnerable
Ubuntudocker.iopro1.12.6-0ubuntu1~16.04.1vulnerable
Ubuntudocker.iopro1.13.1-0ubuntu1~16.04.2vulnerable
Ubuntudocker.iopro17.03.2-0ubuntu2~16.04.1vulnerable
Ubuntudocker.iopro18.06.1-0ubuntu1~16.04.2vulnerable
Ubuntudocker.iopro18.06.1-0ubuntu1.2~16.04.1vulnerable
Ubuntudocker.iopro18.09.2-0ubuntu1~16.04.1vulnerable
Ubuntudocker.iopro18.09.5-0ubuntu1~16.04.2vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.1vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.4vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.5vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.6vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.7vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.9+esm1fixed
Ubuntudocker.io18.041.13.1-0ubuntu6vulnerable
Ubuntudocker.io18.0417.03.2-0ubuntu1vulnerable
Ubuntudocker.io18.0417.03.2-0ubuntu3vulnerable
Ubuntudocker.io18.0417.03.2-0ubuntu5vulnerable
Ubuntudocker.io18.0417.12.1-0ubuntu1vulnerable
Ubuntudocker.io18.0418.06.1-0ubuntu1~18.04.1vulnerable
Ubuntudocker.io18.0418.06.1-0ubuntu1.2~18.04.1vulnerable
Ubuntudocker.io18.0418.09.2-0ubuntu1~18.04.1vulnerable
Ubuntudocker.io18.0418.09.5-0ubuntu1~18.04.2vulnerable
Ubuntudocker.io18.0418.09.7-0ubuntu1~18.04.1vulnerable
Ubuntudocker.io18.0418.09.7-0ubuntu1~18.04.3vulnerable
Ubuntudocker.io18.0418.09.7-0ubuntu1~18.04.4vulnerable
Ubuntudocker.io18.0419.03.6-0ubuntu1~18.04.1vulnerable
Ubuntudocker.io18.0419.03.6-0ubuntu1~18.04.2vulnerable
Ubuntudocker.io18.0419.03.6-0ubuntu1~18.04.3vulnerable
Ubuntudocker.io18.0420.10.2-0ubuntu1~18.04.2vulnerable
Ubuntudocker.io18.0420.10.2-0ubuntu1~18.04.3vulnerable
Ubuntudocker.io18.0420.10.7-0ubuntu1~18.04.1vulnerable
Ubuntudocker.io18.0420.10.7-0ubuntu1~18.04.2fixed
Ubuntudocker.io20.0419.03.2-0ubuntu1vulnerable
Ubuntudocker.io20.0419.03.6-0ubuntu1vulnerable
Ubuntudocker.io20.0419.03.8-0ubuntu1vulnerable
Ubuntudocker.io20.0419.03.8-0ubuntu1.20.04vulnerable
Ubuntudocker.io20.0419.03.8-0ubuntu1.20.04.1vulnerable
Ubuntudocker.io20.0419.03.8-0ubuntu1.20.04.2vulnerable
Ubuntudocker.io20.0420.10.2-0ubuntu1~20.04.2vulnerable
Ubuntudocker.io20.0420.10.2-0ubuntu1~20.04.3vulnerable
Ubuntudocker.io20.0420.10.7-0ubuntu1~20.04.1vulnerable
Ubuntudocker.io20.0420.10.7-0ubuntu1~20.04.2fixed
Susecontainerdlinux enterprise module for containers 15 sp31.4.12-60.1fixed
Susedockerlinux enterprise module for containers 15 sp320.10.12_ce-159.1fixed
Susecontainerdlinux enterprise micro 5.01.4.12-60.1fixed
Susedockerlinux enterprise micro 5.020.10.12_ce-159.1fixed
Susecontainerdlinux enterprise micro 5.11.4.12-60.1fixed
Susedockerlinux enterprise micro 5.120.10.12_ce-159.1fixed
Susecontainerdlinux enterprise module for containers 121.4.12-16.49.1fixed
Susedockerlinux enterprise module for containers 1220.10.12_ce-98.75.1fixed
Opensusecontainerdleap 15.31.4.12-60.1fixed
Opensusedockerleap 15.320.10.12_ce-159.1fixed
Opensusedocker-kubicleap 15.320.10.12_ce-159.1fixed
Ubuntudocker.iopro1.6.2~dfsg1-1ubuntu4vulnerable
Ubuntudocker.iopro1.10.2-0ubuntu3vulnerable
Ubuntudocker.iopro1.10.2-0ubuntu4vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu1vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu4vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu5vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu6vulnerable
Ubuntudocker.iopro1.11.2-0ubuntu5~16.04vulnerable
Ubuntudocker.iopro1.12.1-0ubuntu13~16.04.1vulnerable
Ubuntudocker.iopro1.12.3-0ubuntu4~16.04.2vulnerable
Ubuntudocker.iopro1.12.6-0ubuntu1~16.04.1vulnerable
Ubuntudocker.iopro1.13.1-0ubuntu1~16.04.2vulnerable
Ubuntudocker.iopro17.03.2-0ubuntu2~16.04.1vulnerable
Ubuntudocker.iopro18.06.1-0ubuntu1~16.04.2vulnerable
Ubuntudocker.iopro18.06.1-0ubuntu1.2~16.04.1vulnerable
Ubuntudocker.iopro18.09.2-0ubuntu1~16.04.1vulnerable
Ubuntudocker.iopro18.09.5-0ubuntu1~16.04.2vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.1vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.4vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.5vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.6vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.7vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.9+esm1fixed
Ubuntudocker.io18.041.13.1-0ubuntu6vulnerable
Ubuntudocker.io18.0417.03.2-0ubuntu1vulnerable
Ubuntudocker.io18.0417.03.2-0ubuntu3vulnerable
Ubuntudocker.io18.0417.03.2-0ubuntu5vulnerable
Ubuntudocker.io18.0417.12.1-0ubuntu1vulnerable
Ubuntudocker.io18.0418.06.1-0ubuntu1~18.04.1vulnerable
Ubuntudocker.io18.0418.06.1-0ubuntu1.2~18.04.1vulnerable
Ubuntudocker.io18.0418.09.2-0ubuntu1~18.04.1vulnerable
Ubuntudocker.io18.0418.09.5-0ubuntu1~18.04.2vulnerable
Ubuntudocker.io18.0418.09.7-0ubuntu1~18.04.1vulnerable
Ubuntudocker.io18.0418.09.7-0ubuntu1~18.04.3vulnerable
Ubuntudocker.io18.0418.09.7-0ubuntu1~18.04.4vulnerable
Ubuntudocker.io18.0419.03.6-0ubuntu1~18.04.1vulnerable
Ubuntudocker.io18.0419.03.6-0ubuntu1~18.04.2vulnerable
Ubuntudocker.io18.0419.03.6-0ubuntu1~18.04.3vulnerable
Ubuntudocker.io18.0420.10.2-0ubuntu1~18.04.2vulnerable
Ubuntudocker.io18.0420.10.2-0ubuntu1~18.04.3vulnerable
Ubuntudocker.io18.0420.10.7-0ubuntu1~18.04.1vulnerable
Ubuntudocker.io18.0420.10.7-0ubuntu1~18.04.2fixed
Ubuntudocker.io20.0419.03.2-0ubuntu1vulnerable
Ubuntudocker.io20.0419.03.6-0ubuntu1vulnerable
Ubuntudocker.io20.0419.03.8-0ubuntu1vulnerable
Ubuntudocker.io20.0419.03.8-0ubuntu1.20.04vulnerable
Ubuntudocker.io20.0419.03.8-0ubuntu1.20.04.1vulnerable
Ubuntudocker.io20.0419.03.8-0ubuntu1.20.04.2vulnerable
Ubuntudocker.io20.0420.10.2-0ubuntu1~20.04.2vulnerable
Ubuntudocker.io20.0420.10.2-0ubuntu1~20.04.3vulnerable
Ubuntudocker.io20.0420.10.7-0ubuntu1~20.04.1vulnerable
Ubuntudocker.io20.0420.10.7-0ubuntu1~20.04.2fixed
Ubuntudocker.io22.0420.10.7-0ubuntu5vulnerable
Ubuntudocker.io22.0420.10.7-0ubuntu7fixed
Opensusedockertumbleweed20.10.9_ce-1.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandocker.iosourcesid20.10.10+dfsg1-1not yet assignedNot reportedNot reported
Debiandocker.iosourceforky20.10.10+dfsg1-1not yet assignedNot reportedNot reported
Debiandocker.iosourcetrixie20.10.10+dfsg1-1not yet assignedNot reportedNot reported
Debiandocker.iosourcebookworm20.10.10+dfsg1-1not yet assignedNot reportedNot reported
Ubuntudocker.iodebpro18.09.7-0ubuntu1~16.04.9+esm1Not reportedUSN-5103-1Not reported
Ubuntudocker.iodeb18.0420.10.7-0ubuntu1~18.04.2Not reportedUSN-5103-1Not reported
Ubuntudocker.iodeb20.0420.10.7-0ubuntu1~20.04.2Not reportedUSN-5103-1Not reported
Susecontainerdrpmlinux enterprise module for containers 15 sp31.4.12-60.1Not reportedSUSE-SU-2022:0334-1Not reported
Susedockerrpmlinux enterprise module for containers 15 sp320.10.12_ce-159.1Not reportedSUSE-SU-2022:0334-1Not reported
Susecontainerdrpmlinux enterprise micro 5.01.4.12-60.1Not reportedSUSE-SU-2022:0334-1Not reported
Susedockerrpmlinux enterprise micro 5.020.10.12_ce-159.1Not reportedSUSE-SU-2022:0334-1Not reported
Susecontainerdrpmlinux enterprise micro 5.11.4.12-60.1Not reportedSUSE-SU-2022:0334-1Not reported
Susedockerrpmlinux enterprise micro 5.120.10.12_ce-159.1Not reportedSUSE-SU-2022:0334-1Not reported
Susecontainerdrpmlinux enterprise module for containers 121.4.12-16.49.1Not reportedSUSE-SU-2022:0213-1Not reported
Susedockerrpmlinux enterprise module for containers 1220.10.12_ce-98.75.1Not reportedSUSE-SU-2022:0213-1Not reported
Opensusecontainerdrpmleap 15.31.4.12-60.1Not reportedOPENSUSE-SU-2022:0334-1Not reported
Opensusedockerrpmleap 15.320.10.12_ce-159.1Not reportedOPENSUSE-SU-2022:0334-1Not reported
Opensusedocker-kubicrpmleap 15.320.10.12_ce-159.1Not reportedOPENSUSE-SU-2022:0334-1Not reported
Ubuntudocker.iodebpro18.09.7-0ubuntu1~16.04.9+esm1Not reportedUBUNTU-CVE-2021-41089Not reported
Ubuntudocker.iodeb18.0420.10.7-0ubuntu1~18.04.2Not reportedUBUNTU-CVE-2021-41089Not reported
Ubuntudocker.iodeb20.0420.10.7-0ubuntu1~20.04.2Not reportedUBUNTU-CVE-2021-41089Not reported
Ubuntudocker.iodeb22.0420.10.7-0ubuntu7Not reportedUBUNTU-CVE-2021-41089Not reported
Opensusedockerrpmtumbleweed20.10.9_ce-1.2Not reportedOPENSUSE-SU-2024:11579-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [docker-doc]Unknown

    Source package: [docker.io]

    Details (2)
    • 20.10.24+dfsg1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

    • 20.10.24+dfsg1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

  • [docker.io]Unknown

    Source package: [docker.io]

    Details (2)
    • 20.10.24+dfsg1-1+deb12u1+b6 · amd64 · bookworm

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

    • 20.10.24+dfsg1-1+deb12u1+b6 · arm64 · bookworm

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

  • Source package: [docker.io]

    Details (2)
    • 20.10.24+dfsg1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

    • 20.10.24+dfsg1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

[Debian 13 (Trixie)]

  • [docker-cli]Unknown

    Source package: [docker.io]

    Details (4)
    • 26.1.5+dfsg1-9+b13 · amd64 · trixie

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+b13 · arm64 · trixie

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

  • [docker-doc]Unknown

    Source package: [docker.io]

    Details (4)
    • 26.1.5+dfsg1-9 · all · trixie

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9 · all · trixie

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · all · trixie-security

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · all · trixie-security

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

  • [docker.io]Unknown
    Details (4)
    • 26.1.5+dfsg1-9+b13 · amd64 · trixie

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+b13 · arm64 · trixie

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

  • Source package: [docker.io]

    Details (4)
    • 26.1.5+dfsg1-9 · all · trixie

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9 · all · trixie

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · all · trixie-security

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · all · trixie-security

      Fixed · Fixed: 20.10.10+dfsg1-1

      dsa · docker.io · debian · 13

[openSUSE Tumbleweed]

  • [docker]Unknown

    Source package: [docker]

    Details (1)
    • 29.4.0_ce-40.3 · x86_64 · tumbleweed

      Fixed · Fixed: 20.10.9_ce-1.2

      dsa · docker · opensuse · tumbleweed

  • Source package: [docker]

    Details (1)
    • 29.4.0_ce-40.3 · noarch · tumbleweed

      Unknown · Fixed: 20.10.9_ce-1.2

      Version impact unknown

      dsa · docker · opensuse · tumbleweed

  • [docker-buildx]Unknown

    Source package: [docker]

    Details (1)
    • 0.33.0-40.3 · x86_64 · tumbleweed

      Unknown · Fixed: 20.10.9_ce-1.2

      Version impact unknown

      dsa · docker · opensuse · tumbleweed

  • Source package: [docker]

    Details (1)
    • 29.4.0_ce-40.3 · noarch · tumbleweed

      Unknown · Fixed: 20.10.9_ce-1.2

      Version impact unknown

      dsa · docker · opensuse · tumbleweed

  • Source package: [docker]

    Details (1)
    • 29.4.0_ce-40.3 · noarch · tumbleweed

      Unknown · Fixed: 20.10.9_ce-1.2

      Version impact unknown

      dsa · docker · opensuse · tumbleweed

  • Source package: [docker]

    Details (1)
    • 29.4.0_ce-40.3 · noarch · tumbleweed

      Unknown · Fixed: 20.10.9_ce-1.2

      Version impact unknown

      dsa · docker · opensuse · tumbleweed

Observed:

References