Skip to content

ufw rules are not applied before docker iptables

Low
notthebee published GHSA-79c3-9r24-3jmv May 9, 2023

Package

No package listed

Affected versions

< 0.1

Patched versions

0.1

Description

Summary

Uncomplicated Firewall (UFW) is not blocking anything when using Docker

Details

When Docker is installed, Docker bypass the UFW rules and the published ports can be accessed from outside.

PoC

See: https://github.com/chaifeng/ufw-docker

Impact

The ufw rules for access to 80, 443 (tcp) and 51820 (udp) are meaningless. We should either remove them or make the changes
to have docker exposed ports respect ufw rules.

NOTE More info on this issue can be tracked here: moby/moby#45532

Severity

Low

CVE ID

No known CVE

Weaknesses

No CWEs

Credits