Docker Security Updates: SSO Deprecation, Certifications, and Vulnerability Fixes

When [SSO enforcement](/manuals/security/for-admins/single-sign-on/connect.md) was first introduced, Docker provided a grace period to continue to let passwords be used on the Docker CLI when authenticating to Docker Hub. This was allowed so organizations could more easily use SSO enforcement. It is recommended that administrators configuring SSO encourage users using the CLI [to switch over to Personal Access Tokens](/security/for-admins/single-sign-on/#prerequisites) in anticipation of this grace period ending. On September 16, 2024 the grace period will end and passwords will no longer be able to authenticate to Docker Hub via the Docker CLI when SSO is enforced. Affected users are required to switch over to using PATs to continue signing in. At Docker, we want the experience to be the most secure for our developers and organizations and this deprecation is an essential step in that direction. ## SOC 2 Type 2 attestation and ISO 27001 certification _Last updated June, 2024_ Docker is pleased to announce that we have received our SOC 2 Type 2 attestation and ISO 27001 certification with no exceptions or major non-conformities. Security is a fundamental pillar to Docker’s operations, which is embedded into our overall mission and company strategy. Docker’s products are core to our user community and our SOC 2 Type 2 attestation and ISO 27001 certification demonstrate Docker’s ongoing commitment to security to our user base. For more information, see the [Blog announcement](https://www.docker.com/blog/docker-announces-soc-2-type-2-attestation-iso-27001-certification/). ## Docker Security Advisory: Multiple Vulnerabilities in runc, BuildKit, and Moby _Last updated February 2, 2024_ We at Docker prioritize the security and integrity of our software and the trust of our users. Security researchers at Snyk Labs identified and reported four security vulnerabilities in the container ecosystem. One of the vulnerabilities, [CVE-2024-21626](https://scout.docker.com/v/CVE-2024-21626), concerns the runc container runtime, and the other three affect BuildKit ([CVE-2024-23651](https://scout.docker.com/v/CVE-2024-23651), [CVE-2024-23652](https://scout.docker.com/v/CVE-2024-23652), and [CVE-2024-23653](https://scout.docker.com/v/CVE-2024-23653)). We want to assure our community that our team, in collaboration with the reporters and open source maintainers, has been diligently working on coordinating and implementing necessary remediations. We are committed to maintaining the highest security standards. We have published patched versions of runc, BuildKit, and Moby on January 31 and released an update for Docker Desktop on February 1 to address these vulnerabilities. Additionally, our latest BuildKit and Moby releases included fixes for [CVE-2024-23650](https://scout.docker.com/v/CVE-2024-23650) and [CVE-2024-24557](https://scout.docker.com/v/CVE-2024-24557), discovered respectively by an independent researcher and through Docker’s internal research initiatives. | | Versions Impacted | |:-----------------------|:--------------------------| | `runc` | <= 1.1.11 | | `BuildKit` | <= 0.12.4 | | `Moby (Docker Engine)` | <= 25.0.1 and <= 24.0.8 | | `Docker Desktop` | <= 4.27.0 | ### What should I do if I’m on an affected version? If you are using affected versions of runc, BuildKit, Moby, or Docker Desktop, make sure to update to the latest versions, linked in the following table: | | Patched Versions | |:-----------------------|:--------------------------| | `runc` | >= [1.1.12](https://github.com/opencontainers/runc/releases/tag/v1.1.12) | | `BuildKit` | >= [0.12.5](https://github.com/moby/buildkit/releases/tag/v0.12.5) | | `Moby (Docker Engine)` | >= [25.0.2](https://github.com/moby/moby/releases/tag/v25.0.2) and >= [24.0.9](https://github.com/moby/moby/releases/tag/v24.0.9) |

This section covers several security-related announcements from Docker. First, it reminds users about the upcoming deprecation of password logins on the Docker CLI when SSO is enforced, effective September 16, 2024, and recommends switching to Personal Access Tokens. Next, it highlights Docker's successful achievement of SOC 2 Type 2 attestation and ISO 27001 certification. Finally, it addresses multiple vulnerabilities in runc, BuildKit, and Moby, urging users to update to the latest patched versions to mitigate risks.