In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade docker | Aug 22, 2024 | May 23, 2019 |
| Amazon Linux Ami 2 | — | Upgrade dockerUpgrade docker-debuginfo | Jul 4, 2022 | May 23, 2019 |
| Amazon_linux | — | Upgrade docker | Jul 27, 2019 | May 23, 2019 |
| Centos_linux | — | Upgrade docker-clientUpgrade dockerUpgrade docker-commonUpgrade docker-v1.10-migratorUpgrade docker-novolume-pluginUpgrade docker-debuginfoUpgrade docker-lvm-pluginUpgrade docker-logrotateUpgrade docker-rhel-push-plugin | Aug 28, 2019 | May 23, 2019 |
| Debian | — | Upgrade docker.io | Jul 30, 2024 | May 23, 2019 |
| Docker_ce | — | Upgrade Docker CE to version 18.06.1 or later | Nov 25, 2019 | May 23, 2019 |
| Oracle_linux | — | Upgrade runcUpgrade docker-engineUpgrade docker-cli | Jun 14, 2019 | May 23, 2019 |
| Redhat_linux | — | Upgrade docker-commonUpgrade docker-clientUpgrade docker-v1.10-migratorUpgrade docker-rhel-push-pluginUpgrade docker-debuginfoUpgrade docker-logrotateUpgrade dockerUpgrade docker-novolume-pluginUpgrade docker-lvm-plugin | Jul 30, 2019 | May 23, 2019 |
| Suse | — | Upgrade docker-testUpgrade libfuse3-3Upgrade fuse-overlayfsUpgrade docker-zsh-completionUpgrade podmanUpgrade dockerUpgrade podman-cni-configUpgrade fuse3Upgrade libcontainers-commonUpgrade docker-fish-completionUpgrade docker-bash-completionUpgrade fuse3-develUpgrade fuse3-docUpgrade slirp4netns | Jun 27, 2019 | May 23, 2019 |
| Ubuntu | — | Upgrade docker.io | Jul 9, 2019 | May 23, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 23, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub