CVE catalog

CVE-2022-36109

docker.io: CVE-2022-36109

Severity: Medium · CVSS 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Published: Sep 9, 2022, 6:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.04% · Oct 25, 2026

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	docker.io	sid	`28.5.2+dfsg4-5`	fixed
Debian	docker.io	forky	`28.5.2+dfsg4-5`	fixed
Debian	docker.io	trixie	`26.1.5+dfsg1-9+deb13u1`	fixed
Debian	docker.io	trixie-security	`26.1.5+dfsg1-9+deb13u1`	fixed
Debian	docker.io	bookworm	`20.10.24+dfsg1-1+deb12u1`	fixed
Ubuntu	docker.io	pro	`1.6.2~dfsg1-1ubuntu4`	vulnerable
Ubuntu	docker.io	pro	`1.10.2-0ubuntu3`	vulnerable
Ubuntu	docker.io	pro	`1.10.2-0ubuntu4`	vulnerable
Ubuntu	docker.io	pro	`1.10.3-0ubuntu1`	vulnerable
Ubuntu	docker.io	pro	`1.10.3-0ubuntu4`	vulnerable
Ubuntu	docker.io	pro	`1.10.3-0ubuntu5`	vulnerable
Ubuntu	docker.io	pro	`1.10.3-0ubuntu6`	vulnerable
Ubuntu	docker.io	pro	`1.11.2-0ubuntu5~16.04`	vulnerable
Ubuntu	docker.io	pro	`1.12.1-0ubuntu13~16.04.1`	vulnerable
Ubuntu	docker.io	pro	`1.12.3-0ubuntu4~16.04.2`	vulnerable
Ubuntu	docker.io	pro	`1.12.6-0ubuntu1~16.04.1`	vulnerable
Ubuntu	docker.io	pro	`1.13.1-0ubuntu1~16.04.2`	vulnerable
Ubuntu	docker.io	pro	`17.03.2-0ubuntu2~16.04.1`	vulnerable
Ubuntu	docker.io	pro	`18.06.1-0ubuntu1~16.04.2`	vulnerable
Ubuntu	docker.io	pro	`18.06.1-0ubuntu1.2~16.04.1`	vulnerable
Ubuntu	docker.io	pro	`18.09.2-0ubuntu1~16.04.1`	vulnerable
Ubuntu	docker.io	pro	`18.09.5-0ubuntu1~16.04.2`	vulnerable
Ubuntu	docker.io	pro	`18.09.7-0ubuntu1~16.04.1`	vulnerable
Ubuntu	docker.io	pro	`18.09.7-0ubuntu1~16.04.4`	vulnerable
Ubuntu	docker.io	pro	`18.09.7-0ubuntu1~16.04.5`	vulnerable
Ubuntu	docker.io	pro	`18.09.7-0ubuntu1~16.04.6`	vulnerable
Ubuntu	docker.io	pro	`18.09.7-0ubuntu1~16.04.7`	vulnerable
Ubuntu	docker.io	pro	`18.09.7-0ubuntu1~16.04.9+esm1`	vulnerable
Ubuntu	docker.io	pro	`18.09.7-0ubuntu1~16.04.9+esm2`	vulnerable
Ubuntu	docker.io	18.04	`1.13.1-0ubuntu6`	vulnerable
Ubuntu	docker.io	18.04	`17.03.2-0ubuntu1`	vulnerable
Ubuntu	docker.io	18.04	`17.03.2-0ubuntu3`	vulnerable
Ubuntu	docker.io	18.04	`17.03.2-0ubuntu5`	vulnerable
Ubuntu	docker.io	18.04	`17.12.1-0ubuntu1`	vulnerable
Ubuntu	docker.io	18.04	`18.06.1-0ubuntu1~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`18.06.1-0ubuntu1.2~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`18.09.2-0ubuntu1~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`18.09.5-0ubuntu1~18.04.2`	vulnerable
Ubuntu	docker.io	18.04	`18.09.7-0ubuntu1~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`18.09.7-0ubuntu1~18.04.3`	vulnerable
Ubuntu	docker.io	18.04	`18.09.7-0ubuntu1~18.04.4`	vulnerable
Ubuntu	docker.io	18.04	`19.03.6-0ubuntu1~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`19.03.6-0ubuntu1~18.04.2`	vulnerable
Ubuntu	docker.io	18.04	`19.03.6-0ubuntu1~18.04.3`	vulnerable
Ubuntu	docker.io	18.04	`20.10.2-0ubuntu1~18.04.2`	vulnerable
Ubuntu	docker.io	18.04	`20.10.2-0ubuntu1~18.04.3`	vulnerable
Ubuntu	docker.io	18.04	`20.10.7-0ubuntu1~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`20.10.7-0ubuntu1~18.04.2`	vulnerable
Ubuntu	docker.io	18.04	`20.10.7-0ubuntu5~18.04.2`	vulnerable
Ubuntu	docker.io	18.04	`20.10.7-0ubuntu5~18.04.3`	vulnerable
Ubuntu	docker.io	18.04	`20.10.12-0ubuntu2~18.04.1`	vulnerable
Ubuntu	docker.io	18.04	`20.10.21-0ubuntu1~18.04.2`	fixed
Ubuntu	docker.io	20.04	`19.03.2-0ubuntu1`	vulnerable
Ubuntu	docker.io	20.04	`19.03.6-0ubuntu1`	vulnerable
Ubuntu	docker.io	20.04	`19.03.8-0ubuntu1`	vulnerable
Ubuntu	docker.io	20.04	`19.03.8-0ubuntu1.20.04`	vulnerable
Ubuntu	docker.io	20.04	`19.03.8-0ubuntu1.20.04.1`	vulnerable
Ubuntu	docker.io	20.04	`19.03.8-0ubuntu1.20.04.2`	vulnerable
Ubuntu	docker.io	20.04	`20.10.2-0ubuntu1~20.04.2`	vulnerable
Ubuntu	docker.io	20.04	`20.10.2-0ubuntu1~20.04.3`	vulnerable
Ubuntu	docker.io	20.04	`20.10.7-0ubuntu1~20.04.1`	vulnerable
Ubuntu	docker.io	20.04	`20.10.7-0ubuntu1~20.04.2`	vulnerable
Ubuntu	docker.io	20.04	`20.10.7-0ubuntu5~20.04.1`	vulnerable
Ubuntu	docker.io	20.04	`20.10.7-0ubuntu5~20.04.2`	vulnerable
Ubuntu	docker.io	20.04	`20.10.12-0ubuntu2~20.04.1`	vulnerable
Ubuntu	docker.io	20.04	`20.10.21-0ubuntu1~20.04.1`	fixed
Ubuntu	docker.io	22.04	`20.10.7-0ubuntu5`	vulnerable
Ubuntu	docker.io	22.04	`20.10.7-0ubuntu7`	vulnerable
Ubuntu	docker.io	22.04	`20.10.12-0ubuntu1`	vulnerable
Ubuntu	docker.io	22.04	`20.10.12-0ubuntu2`	vulnerable
Ubuntu	docker.io	22.04	`20.10.12-0ubuntu3`	vulnerable
Ubuntu	docker.io	22.04	`20.10.12-0ubuntu3+gke1.24.1`	vulnerable
Ubuntu	docker.io	22.04	`20.10.12-0ubuntu4`	vulnerable
Ubuntu	docker.io	22.04	`20.10.21-0ubuntu1~22.04.2`	fixed
Suse	docker	linux enterprise module for containers 12	`20.10.23_ce-98.89.1`	fixed
Suse	docker	linux enterprise micro 5.3	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	linux enterprise module for containers 15 sp4	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	linux enterprise high performance computing 15 sp1-ltss	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	linux enterprise high performance computing 15 sp2-ltss	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	linux enterprise high performance computing 15 sp3-espos	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	linux enterprise high performance computing 15 sp3-ltss	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	linux enterprise server 15 sp1-ltss	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	linux enterprise server 15 sp2-ltss	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	linux enterprise server 15 sp3-ltss	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	linux enterprise server for sap applications 15 sp1	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	linux enterprise server for sap applications 15 sp2	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	linux enterprise server for sap applications 15 sp3	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	linux enterprise micro 5.1	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	linux enterprise micro 5.2	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	enterprise storage 7	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	enterprise storage 7.1	`20.10.23_ce-150000.175.1`	fixed
Opensuse	docker	leap micro 5.3	`20.10.23_ce-150000.175.1`	fixed
Opensuse	docker	leap 15.4	`20.10.23_ce-150000.175.1`	fixed
Suse	docker	linux enterprise micro 5.4	`20.10.23_ce-150000.175.1`	fixed
Opensuse	docker	tumbleweed	`20.10.23_ce-2.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	docker.io	source	sid	`20.10.19+dfsg1-1`	not yet assigned	Not reported	[1019601]
Debian	docker.io	source	forky	`20.10.19+dfsg1-1`	not yet assigned	Not reported	[1019601]
Debian	docker.io	source	trixie	`20.10.19+dfsg1-1`	not yet assigned	Not reported	[1019601]
Debian	docker.io	source	bookworm	`20.10.19+dfsg1-1`	not yet assigned	Not reported	[1019601]
Ubuntu	docker.io	deb	18.04	`20.10.21-0ubuntu1~18.04.2`	Not reported	UBUNTU-CVE-2022-36109	Not reported
Ubuntu	docker.io	deb	20.04	`20.10.21-0ubuntu1~20.04.1`	Not reported	UBUNTU-CVE-2022-36109	Not reported
Ubuntu	docker.io	deb	22.04	`20.10.21-0ubuntu1~22.04.2`	Not reported	UBUNTU-CVE-2022-36109	Not reported
Suse	docker	rpm	linux enterprise module for containers 12	`20.10.23_ce-98.89.1`	Not reported	SUSE-SU-2023:1625-1	Not reported
Suse	docker	rpm	linux enterprise micro 5.3	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	linux enterprise module for containers 15 sp4	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	linux enterprise high performance computing 15 sp1-ltss	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	linux enterprise high performance computing 15 sp2-ltss	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	linux enterprise high performance computing 15 sp3-espos	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	linux enterprise high performance computing 15 sp3-ltss	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	linux enterprise server 15 sp1-ltss	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	linux enterprise server 15 sp2-ltss	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	linux enterprise server 15 sp3-ltss	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	linux enterprise server for sap applications 15 sp1	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	linux enterprise server for sap applications 15 sp2	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	linux enterprise server for sap applications 15 sp3	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	linux enterprise micro 5.1	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	linux enterprise micro 5.2	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	enterprise storage 7	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	enterprise storage 7.1	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Opensuse	docker	rpm	leap micro 5.3	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Opensuse	docker	rpm	leap 15.4	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-1	Not reported
Suse	docker	rpm	linux enterprise micro 5.4	`20.10.23_ce-150000.175.1`	Not reported	SUSE-SU-2023:0795-2	Not reported
Opensuse	docker	rpm	tumbleweed	`20.10.23_ce-2.1`	Not reported	OPENSUSE-SU-2024:12790-1	Not reported

[Debian bug #1019601]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[docker-doc]Unknown
Source package: [docker.io]
Details (2)
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Fixed · Fixed: 20.10.19+dfsg1-1
  dsa · docker.io · debian · bookworm
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Fixed · Fixed: 20.10.19+dfsg1-1
  dsa · docker.io · debian · bookworm
[docker.io]Unknown
Source package: [docker.io]
Details (2)
- 20.10.24+dfsg1-1+deb12u1+b6 · amd64 · bookworm
  Fixed · Fixed: 20.10.19+dfsg1-1
  dsa · docker.io · debian · bookworm
- 20.10.24+dfsg1-1+deb12u1+b6 · arm64 · bookworm
  Fixed · Fixed: 20.10.19+dfsg1-1
  dsa · docker.io · debian · bookworm
[golang-github-docker-docker-dev]Unknown
Source package: [docker.io]
Details (2)
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Fixed · Fixed: 20.10.19+dfsg1-1
  dsa · docker.io · debian · bookworm
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Fixed · Fixed: 20.10.19+dfsg1-1
  dsa · docker.io · debian · bookworm

[openSUSE Tumbleweed]

[docker]Unknown
Source package: [docker]
Details (1)
- 29.4.0_ce-40.3 · x86_64 · tumbleweed
  Fixed · Fixed: 20.10.23_ce-2.1
  dsa · docker · opensuse · tumbleweed
[docker-bash-completion]Unknown
Source package: [docker]
Details (1)
- 29.4.0_ce-40.3 · noarch · tumbleweed
  Unknown · Fixed: 20.10.23_ce-2.1
  Version impact unknown
  dsa · docker · opensuse · tumbleweed
[docker-buildx]Unknown
Source package: [docker]
Details (1)
- 0.33.0-40.3 · x86_64 · tumbleweed
  Unknown · Fixed: 20.10.23_ce-2.1
  Version impact unknown
  dsa · docker · opensuse · tumbleweed
[docker-fish-completion]Unknown
Source package: [docker]
Details (1)
- 29.4.0_ce-40.3 · noarch · tumbleweed
  Unknown · Fixed: 20.10.23_ce-2.1
  Version impact unknown
  dsa · docker · opensuse · tumbleweed
[docker-rootless-extras]Unknown
Source package: [docker]
Details (1)
- 29.4.0_ce-40.3 · noarch · tumbleweed
  Unknown · Fixed: 20.10.23_ce-2.1
  Version impact unknown
  dsa · docker · opensuse · tumbleweed
[docker-zsh-completion]Unknown
Source package: [docker]
Details (1)
- 29.4.0_ce-40.3 · noarch · tumbleweed
  Unknown · Fixed: 20.10.23_ce-2.1
  Version impact unknown
  dsa · docker · opensuse · tumbleweed

Observed: Oct 23, 2026, 6:28:30 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]