CVE-2024-36623

High

Advisory

Published 29 Nov 2024In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 8.1; base score, highest
EPSS: 0.006; 49th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 18; of 17,781 indexed, latest versions
Container images: 20; deployed by those charts
Fix available: 1 of 2; affected packages

Moby Race Condition vulnerability

Carried by container images the latest versions of 18 of 17,781 indexed charts deploy, on 20 images.

Affected package	Affected versions	Fixed in	Images
github.com/moby/mobygolang	v0.7.3-0.20190826074503-38ab9da00309, v1.4.2-0.20170731201646-1009e6a40b29, v1.13.1, v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible+1 more	25.0.4	19
docker.iodeb	20.10.24+dfsg1-1+deb12u1+b6	no fix listed	1

OSV records: DEBIAN-CVE-2024-36623 GHSA-gh5c-3h97-2f3q
Also known as: GO-2024-3305

Charts affected

18 by stars

Chart

Latest

Affected images

Radar Score

helm-exportersstarcher

0.5.0

1 of 1 See more

helm-exporter sstarcher 0.5.0

1 of the 1 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
sstarcher/helm-exporter :0.5.0	11769d01ba35	github.com/moby/moby@v0.7.3-0.20190826074503-38ab9da00309	25.0.4

Open the chart page →

4,154

openshift-consoleav1o-charts

0.3.6

1 of 1 See more

openshift-console av1o-charts 0.3.6

1 of the 1 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
quay.io/openshift/origin-console :4.10.0	0bbe8b451fa3	github.com/moby/moby@v0.7.3-0.20190826074503-38ab9da00309	25.0.4

Open the chart page →

9,052

dapr-dashboarddapr

0.15.0

1 of 1 See more

dapr-dashboard dapr 0.15.0

1 of the 1 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
daprio/dashboard :0.15.0	4be696707bd1	github.com/moby/moby@v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	25.0.4

Open the chart page →

1,301

hiverhiver

0.1.45

1 of 10 See more

hiver hiver 0.1.45

1 of the 10 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
hiversh/controller :0.1.45	b0b85f8942c7	docker.io@20.10.24+dfsg1-1+deb12u1+b6	no fix listed

Open the chart page →

21,672

jetic-operatorjetic-operator

2.0.2

1 of 1 See more

jetic-operator jetic-operator 2.0.2

1 of the 1 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
apache/camel-k :1.10.4	3bb13d14f64a	github.com/moby/moby@v0.7.3-0.20190826074503-38ab9da00309	25.0.4

Open the chart page →

9,318

traefik-forward-authmesosphere

0.3.10

1 of 2 See more

traefik-forward-auth mesosphere 0.3.10

1 of the 2 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
mesosphere/kubeaddons-addon-initializer :v0.5.1	5efa21defcbc	github.com/moby/moby@v1.13.1	25.0.4

Open the chart page →

5,308

gloosolo-gloo-edge

0.0.0-fork

2 of 5 See more

gloo solo-gloo-edge 0.0.0-fork

2 of the 5 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
quay.io/solo-io/discovery :0.0.0-fork	5b62aaade3c9	github.com/moby/moby@v20.10.14+incompatible	25.0.4
quay.io/solo-io/gloo :0.0.0-fork	9a6c84560d44	github.com/moby/moby@v20.10.14+incompatible	25.0.4

Open the chart page →

9,224

amorphieamorphie

0.1.2

1 of 18 See more

amorphie amorphie 0.1.2

1 of the 18 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
daprio/dashboard :0.14.0	7ba5d51e5b97	github.com/moby/moby@v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	25.0.4

Open the chart page →

28,131

docker-machine-operatorappscode

2024.7.9

1 of 1 See more

docker-machine-operator appscode 2024.7.9

1 of the 1 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/docker-machine-operator :v0.0.4	81f6007abb4e	github.com/moby/moby@v1.4.2-0.20170731201646-1009e6a40b29	25.0.4

Open the chart page →

2,220

helm-controllerazureorkestra

0.1.1

2 of 2 See more

helm-controller azureorkestra 0.1.1

2 of the 2 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
fluxcd/helm-controller :v0.9.0	92b891e495d8	github.com/moby/moby@v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	25.0.4
fluxcd/source-controller :v0.10.0	31a8c79a6803	github.com/moby/moby@v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	25.0.4

Open the chart page →

7,705

ambassador-operatordatawire

0.3.0

1 of 1 See more

ambassador-operator datawire 0.3.0

1 of the 1 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
datawire/ambassador-operator :v1.3.0	f95ae710d75c	github.com/moby/moby@v0.7.3-0.20190826074503-38ab9da00309	25.0.4

Open the chart page →

7,486

azure-pipelines-agentfermosit

0.0.1

1 of 1 See more

azure-pipelines-agent fermosit 0.0.1

1 of the 1 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
jmferrer/azure-devops-agent :latest	030f68ec6998	github.com/moby/moby@v0.7.3-0.20190826074503-38ab9da00309	25.0.4

Open the chart page →

14,673

kioskloft

0.2.11

1 of 1 See more

kiosk loft 0.2.11

1 of the 1 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
kiosksh/kiosk :0.2.11	501725ba2025	github.com/moby/moby@v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	25.0.4

Open the chart page →

3,086

kommandermesosphere-stable

0.39.2

1 of 29 See more

kommander mesosphere-stable 0.39.2

1 of the 29 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
mesosphere/kubeaddons-addon-initializer :v0.2.8	c10011f866f2	github.com/moby/moby@v1.13.1	25.0.4

Open the chart page →

68,284

opsportalmesosphere-stable

0.9.5

1 of 3 See more

opsportal mesosphere-stable 0.9.5

1 of the 3 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
mesosphere/kubeaddons-addon-initializer :v0.2.0	9f863160127b	github.com/moby/moby@v1.13.1	25.0.4

Open the chart page →

7,027

istio-operatormetakube

1.12.0

1 of 1 See more

istio-operator metakube 1.12.0

1 of the 1 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
istio/operator :1.12.0	6cfce8a071b9	github.com/moby/moby@v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	25.0.4

Open the chart page →

8,902

gitlab-runner-operatorpnnl-miscscripts

0.1.6

1 of 1 See more

gitlab-runner-operator pnnl-miscscripts 0.1.6

1 of the 1 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
pnnlmiscscripts/gitlab-runner-operator :0.1.3-1	155131891741	github.com/moby/moby@v0.7.3-0.20190826074503-38ab9da00309	25.0.4

Open the chart page →

11,151

stackrox-chartredhat-cop

0.0.10

1 of 1 See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2024-36623.

Container image	Digest	Package	Fixed in
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	github.com/moby/moby@v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	25.0.4

Open the chart page →

29,227

Container images carrying it

20 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
apache/camel-k :1.10.4	3bb13d14f64a	github.com/moby/moby@v0.7.3-0.20190826074503-38ab9da00309	25.0.4	1
daprio/dashboard :0.15.0	4be696707bd1	github.com/moby/moby@v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	25.0.4	1
daprio/dashboard :0.14.0	7ba5d51e5b97	github.com/moby/moby@v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	25.0.4	1
datawire/ambassador-operator :v1.3.0	f95ae710d75c	github.com/moby/moby@v0.7.3-0.20190826074503-38ab9da00309	25.0.4	1
fluxcd/helm-controller :v0.9.0	92b891e495d8	github.com/moby/moby@v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	25.0.4	1
fluxcd/source-controller :v0.10.0	31a8c79a6803	github.com/moby/moby@v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	25.0.4	1
hiversh/controller :0.1.45	b0b85f8942c7	docker.io@20.10.24+dfsg1-1+deb12u1+b6	no fix listed	1
istio/operator :1.12.0	6cfce8a071b9	github.com/moby/moby@v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	25.0.4	1
jmferrer/azure-devops-agent :latest	030f68ec6998	github.com/moby/moby@v0.7.3-0.20190826074503-38ab9da00309	25.0.4	1
kiosksh/kiosk :0.2.11	501725ba2025	github.com/moby/moby@v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	25.0.4	1
mesosphere/kubeaddons-addon-initializer :v0.5.1	5efa21defcbc	github.com/moby/moby@v1.13.1	25.0.4	1
mesosphere/kubeaddons-addon-initializer :v0.2.0	9f863160127b	github.com/moby/moby@v1.13.1	25.0.4	1
mesosphere/kubeaddons-addon-initializer :v0.2.8	c10011f866f2	github.com/moby/moby@v1.13.1	25.0.4	1
pnnlmiscscripts/gitlab-runner-operator :0.1.3-1	155131891741	github.com/moby/moby@v0.7.3-0.20190826074503-38ab9da00309	25.0.4	1
sstarcher/helm-exporter :0.5.0	11769d01ba35	github.com/moby/moby@v0.7.3-0.20190826074503-38ab9da00309	25.0.4	1
ghcr.io/appscode/docker-machine-operator :v0.0.4	81f6007abb4e	github.com/moby/moby@v1.4.2-0.20170731201646-1009e6a40b29	25.0.4	1
quay.io/openshift/origin-console :4.10.0	0bbe8b451fa3	github.com/moby/moby@v0.7.3-0.20190826074503-38ab9da00309	25.0.4	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	github.com/moby/moby@v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	25.0.4	1
quay.io/solo-io/discovery :0.0.0-fork	5b62aaade3c9	github.com/moby/moby@v20.10.14+incompatible	25.0.4	1
quay.io/solo-io/gloo :0.0.0-fork	9a6c84560d44	github.com/moby/moby@v20.10.14+incompatible	25.0.4	1