[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CA+q1=fSNAzwjywo9qnkRyO0S7refmUZFFciMyKcKE6oNoQjRLQ@mail.gmail.com>
Date: Mon, 5 Sep 2016 16:06:10 -0700
From: Diogo Mónica <diogo.monica@...ker.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: Re: cve request: docker swarmkit Dos occurs by
repeatly joining and quitting swam cluster as a node
>
> DoS is often a gray area. Obviously if I send 10 gigabits of request
> traffic and swarm gets slow/non responsive the CVE response would be "Well
> yeah... that's probably what happens if you saturate the network with
> requests. No CVE for you" but if a single node behaves in an odd way and
> prevents the whole system from working in an expected manner, that may be a
> problem that is worth a CVE, especially if it can be triggered by an
> attacker/less trusted user (classic trust boundary violation to quote
> @sushidude).
>
Again, there is no trust boundary violation. You have a token that allows
you to join an unlimited number of workers. The system supports N workers,
you join N + 1, the system starts rejecting new workers.
No malicious attacker can ever join any workers unless they have the token,
and if you are paranoid, you can always rotate the secret token after each
worker join.
> Regardless of whether this is CVE worthy is there any plan to add rate
> limiting or other protective measures to prevent a single badly
> behaved/malicious node from making the swarm unable to operate normally? I
> don't see any issues in https://github.com/docker/swarm/issues for this.
> Thanks!
>
I don't believe this is the right thread to discuss other topics. I'm here
to get this CVE rescinded, since there is no reason for its existence in
the first place.
If you'd like to discuss any other matters related to docker or swarm, feel
free to do so by either open an issue on our GH repository, or our forums:
https://forums.docker.com.
Thank you,
Diogo Monica
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
