GHSA-5qgp-p5jc-w2rm CVE-2014-6407 GO-2022-0630
Arbitrary Code Execution in Docker
- Severity
- 7.3 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 4.91%
- Chance of exploitation in the next 30 days. Higher than 92.11% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
- Fix
1.3.2- Upgrade github.com/docker/docker to this version or later
Description
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/docker/docker | < 1.3.2 |
1.3.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/docker/docker Go → 1.3.2
- go
go get github.com/docker/docker@v1.3.2 && go mod tidy
Severity breakdown
CVSS 3.1 7.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Weakness
CWE-59: Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
References
Advisories
Other links
- github.com/docker/docker/commit/3ac6394b8082d4700483d52fbfe54914be537d9e
- docs.docker.com/v1.3/release-notes
- lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html
- lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html
- secunia.com/advisories/60171
- secunia.com/advisories/60241
- web.nvd.nist.gov/view/vuln/detail
- openwall.com/lists/oss-security/2014/11/24/5
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-rg2x-37c3-w2rh Docker: Race condition in docker cp allows bind mount redirection to host path | High | Also affects github.com/docker/docker |
| GHSA-vp62-88p7-qqf5 Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap | Medium | Also affects github.com/docker/docker |
| GHSA-x86f-5xw2-fm2r Docker: `PUT /containers/{id}/archive` executes container binary on the host | High | Also affects github.com/docker/docker |
| GO-2026-4887 Moby has AuthZ plugin bypass when provided oversized request bodies | High | Also affects github.com/docker/docker |
| GHSA-pxq6-2prw-chj9 Moby has an Off-by-one error in its plugin privilege validation | High | Also affects github.com/docker/docker |
| GHSA-4vq8-7jfc-9cvp Moby firewalld reload removes bridge network isolation | Medium | Also affects github.com/docker/docker |
| GHSA-x4rx-4gw3-53p4 Moby firewalld reload makes published container ports accessible from remote hosts | Medium | Also affects github.com/docker/docker |
| GHSA-v23v-6jw2-98fq Authz zero length regression | Critical | Also affects github.com/docker/docker |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor