CVE-2014-6407: High severity Docker docker vulnerability
Published Dec 12, 2014
·Updated
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.
Affected Software
3 affected components
Docker docker<=1.3.1
Docker docker=1.0.0
Docker docker=1.3.0
Event History
Dec 12, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-6407?
CVE-2014-6407 has a high severity rating due to the potential for remote code execution and unauthorized file access.
2
How do I fix CVE-2014-6407?
To fix CVE-2014-6407, upgrade to Docker version 1.3.2 or later.
3
What systems are affected by CVE-2014-6407?
CVE-2014-6407 affects Docker versions 1.0.0 to 1.3.1.
4
What types of attacks are possible using CVE-2014-6407?
CVE-2014-6407 allows attackers to exploit symlink or hard link attacks to write to arbitrary files.
5
When was CVE-2014-6407 reported?
CVE-2014-6407 was reported in December 2014.