Описание
Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.
It was found that a malicious container image could overwrite arbitrary portions of the host file system by including absolute symlinks, potentially leading to privilege escalation.
Отчет
- This issue affects the versions of Docker as shipped with Red Hat Enterprise Linux 7. However, this flaw is not known to be exploitable under any supported scenario. A future update may address this issue.
- Red Hat does not support or recommend running untrusted images.
- In Red Hat OpenStack Platform, because the flaw's impact is low and docker is not directly used by the director-operator, no update will be provided at this time for the operator containers.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenStack Platform 16.2 | osp-director-provisioner-container | Will not fix | ||
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8-tech-preview/osp-director-downloader | Will not fix | ||
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8-tech-preview/osp-director-operator | Will not fix | ||
| Red Hat Enterprise Linux 7 Extras | docker | Fixed | RHSA-2015:0623 | 05.03.2015 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS2
Связанные уязвимости
Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.
Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.
Path traversal vulnerability in Docker before 1.3.3 allows remote atta ...
EPSS
5.4 Medium
CVSS2