Hi,

The following vulnerability was published for docker.io.

CVE-2025-54410[0]:
| Moby is an open source container framework developed by Docker Inc.
| that is distributed as Docker Engine, Mirantis Container Runtime,
| and various other downstream projects/products. A firewalld
| vulnerability affects Moby releases before 28.0.0. When firewalld
| reloads, Docker fails to re-create iptables rules that isolate
| bridge networks, allowing any container to access all ports on any
| other container across different bridge networks on the same host.
| This breaks network segmentation between containers that should be
| isolated, creating significant risk in multi-tenant environments.
| Only containers in --internal networks remain protected. Workarounds
| include reloading firewalld and either restarting the docker daemon,
| re-creating bridge networks, or using rootless mode. Maintainers
| anticipate a fix for this issue in version 25.0.13.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-54410
https://www.cve.org/CVERecord?id=CVE-2025-54410
[1] https://github.com/moby/moby/security/advisories/GHSA-4vq8-7jfc-9cvp

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Salvatore Bonaccorso <carnil@debian.org> writes:

I worked on backporting the relevant upstream patches and published my
WIP branch to https://salsa.debian.org/go-team/packages/docker/-/merge_requests/17

Additionally, I've asked Tianon for feedback and got some eyes from the
original author Rob on the issue. To quote from
https://salsa.debian.org/go-team/packages/docker/-/merge_requests/17#note_658404

I agree with Tianon that while we have a patch that appars to be
correct, the risk of introducing unintended regressions is too high for
fixing this minor issue. As such, I'm marking this bug as "wontfix" with
severity minor.

I'm leaving this bug open, and plan to close it with an upcoming (major)
version upgrade.  If you think there are compelling reasons for
uploading this patch to unstable or even stable, please reply to this bug!

Thanks for everyone involved in this issues. Somethings not doing
anything is indeed the best outcome :-)

Best,
-rt

Hi Salvatore,

As noted in the upstream advisory (GHSA-4vq8-7jfc-9cvp), CVE-2025-54410
affects Moby releases prior to 28.0.0 and was fixed upstream in Moby 28.0.0.

In Debian unstable (sid), docker.io was upgraded to the 28.x series in
version 28.5.2+dfsg1-1, where this vulnerability is resolved.

I am therefore closing this bug with version 28.5.2+dfsg1-1.

Thanks,
Reinhard