CVE-2014-9356: Path Traversal
First published: Wed Dec 10 2014(Updated: )
A problem was reported by Docker Inc. whereby a malicious image could overwrite arbitrary portions of the host filesystem by including absolute symlinks. From the upstream report: "Path traversal attacks are possible in the processing of absolute symlinks. In checking symlinks for traversals, only relative links were considered. This allowed path traversals to exist where they should have otherwise been prevented. This was exploitable via both archive extraction and through volume mounts. This vulnerability allowed malicious images or builds from malicious Dockerfiles to write files to the host system and escape containerization, leading to privilege escalation."
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Docker Docker | <1.3.3 | |
| go/github.com/docker/docker | <1.3.3 | 1.3.3 |
| <1.3.3 | ||
| redhat/docker | <1.3.3 | 1.3.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://groups.google.com/forum/#!topic/docker-user/nFAz-B-n4Bw
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1173324
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1173325
- https://bugzilla.redhat.com/show_bug.cgi?id=1172761
- http://www.securityfocus.com/archive/1/archive/1/534215/100/0/threaded
- https://nvd.nist.gov/vuln/detail/CVE-2014-9356
- https://access.redhat.com/security/cve/cve-2014-9356
- https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9356
- https://github.com/advisories/GHSA-vj3f-3286-r4pf (Advisory)
Frequently Asked Questions
What is CVE-2014-9356?
CVE-2014-9356 is a path traversal vulnerability in Docker before version 1.3.3.
What is the severity of CVE-2014-9356?
The severity of CVE-2014-9356 is high, with a CVSS score of 8.6.
How does CVE-2014-9356 work?
CVE-2014-9356 allows remote attackers to write to arbitrary files and bypass container protection mechanisms using a symlink in an image or Dockerfile.
Which software versions are affected by CVE-2014-9356?
Versions of Docker before 1.3.3 are affected by CVE-2014-9356.
How can CVE-2014-9356 be remediated?
To fix CVE-2014-9356, update Docker to version 1.3.3 or later.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-vj3f-3286-r4pf
- alias/CVE-2014-9356
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- agent/severity
- agent/description
- agent/weakness
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/docker
- canonical/docker docker
- package-manager/go
- package-manager/redhat