Docker Engine 19.03 Release Notes (19.03.13

- Clean up network sandbox on failure [moby/moby#41081](https://github.com/moby/moby/pull/41081) - Fix shallow error messages by forwarding deadline-related errors to user [moby/moby#41312](https://github.com/moby/moby/pull/41312) - Fix leaking of netns file descriptors [moby/moby#41287](https://github.com/moby/moby/41287) ### Rootless - Fix port forwarder resource leak [moby/moby#41277](https://github.com/moby/moby/pull/41277) ### Runtime - Bump Golang 1.13.15 [moby/moby#41334](https://github.com/moby/moby/pull/41334) - Update to containerd 1.3.7 [moby/moby#40408](https://github.com/moby/moby/pull/40408) ### Windows - Fix slow Windows container start time when using servercore image [moby/moby#41192](https://github.com/moby/moby/pull/41192) ## 19.03.12 2020-06-18 ### Client - Fix bug preventing logout from registry when using multiple config files (e.g. Windows vs WSL2 when using Docker Desktop) [docker/cli#2592](https://github.com/docker/cli/pull/2592) - Fix regression preventing context metadata to be read [docker/cli#2586](https://github.com/docker/cli/pull/2586) - Bump Golang 1.13.12 [docker/cli#2575](https://github.com/docker/cli/pull/2575) ### Networking - Fix regression preventing daemon start up in a systemd-nspawn environment [moby/moby#41124](https://github.com/moby/moby/pull/41124) [moby/libnetwork#2567](https://github.com/moby/libnetwork/pull/2567) - Fix the retry logic for creating overlay networks in swarm [moby/moby#41124](https://github.com/moby/moby/pull/41124) [moby/libnetwork#2565](https://github.com/moby/libnetwork/pull/2565) ### Runtime - Bump Golang 1.13.12 [moby/moby#41082](https://github.com/moby/moby/pull/41082) ## 19.03.11 2020-06-01 ### Network Disable IPv6 Router Advertisements to prevent address spoofing. [CVE-2020-13401](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13401) **Description** In the Docker default configuration, the container network interface is a virtual ethernet link going to the host (veth interface). In this configuration, an attacker able to run a process as root in a container can send and receive arbitrary packets to the host using the `CAP_NET_RAW` capability (present in the default configuration). If IPv6 is not totally disabled on the host (via `ipv6.disable=1` on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it’s pretty likely that ipv6 forwarding is disabled, that is, `/proc/sys/net/ipv6/conf//forwarding == 0`. Also by default, `/proc/sys/net/ipv6/conf//accept_ra == 1`. The combination of these 2 sysctls means that the host accepts router advertisements and configures the IPv6 stack using them. By sending “rogue” router advertisements from a container, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker-controlled container. Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond. If by chance the host has a vulnerability like last year’s RCE in apt (CVE-2019-3462), the attacker can now escalate to the host. As `CAP_NET_ADMIN` is not present by default for Docker containers, the attacker can’t configure the IPs they want to MitM, they can’t use iptables to NAT or REDIRECT the traffic, and they can’t use `IP_TRANSPARENT`. The attacker can however still use `CAP_NET_RAW` and implement a tcp/ip stack in user space. See [kubernetes/kubernetes#91507](https://github.com/kubernetes/kubernetes/issues/91507) for related issues. ## 19.03.10 2020-05-29 ### Client - Fix version negotiation with older engine. [docker/cli#2538](https://github.com/docker/cli/pull/2538) - Avoid setting SSH flags through hostname. [docker/cli#2560](https://github.com/docker/cli/pull/2560) - Fix panic when DOCKER_CLI_EXPERIMENTAL is invalid. [docker/cli#2558](https://github.com/docker/cli/pull/2558) - Avoid potential panic on s390x by upgrading Go to 1.13.11. [docker/cli#2532](https://github.com/docker/cli/pull/2532)

This document summarizes release notes for Docker Engine versions 19.03.13 through 19.03.10. It includes fixes and updates for networking, rootless mode, runtime, Windows containers, and client functionalities. A security issue (CVE-2020-13401) related to IPv6 Router Advertisements is addressed in version 19.03.11. The notes also cover Go version updates and bug fixes in the client related to version negotiation, SSH flags, and potential panics.