CVE-2018-20699
First published: Sat Jan 12 2019(Updated: )
Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Docker Engine | <18.09 | |
| Redhat Enterprise Linux Server | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/docker/engine/pull/70
- https://github.com/moby/moby/pull/37967
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1666568
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1666566
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1666567
- https://github.com/projectatomic/docker/commit/11e17d3b79bc450a52d5e1dd1c1444f7ebe5f751
- https://access.redhat.com/errata/RHSA-2019:0487
- https://bugzilla.redhat.com/show_bug.cgi?id=1666565
Frequently Asked Questions
What is CVE-2018-20699?
CVE-2018-20699 is a vulnerability in Docker Engine that allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value.
What is the severity of CVE-2018-20699?
CVE-2018-20699 has a severity rating of 4.9, which is considered medium.
How can CVE-2018-20699 be exploited?
CVE-2018-20699 can be exploited by providing a large integer in the --cpuset-mems or --cpuset-cpus value.
Is Docker Engine version 18.09 affected by CVE-2018-20699?
Yes, Docker Engine version 18.09 is affected by CVE-2018-20699.
How can I fix CVE-2018-20699?
To fix CVE-2018-20699, upgrade to a version of Docker Engine that is not affected by the vulnerability.
- collector/nvd-index
- agent/references
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/remedy
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-20699
- agent/type
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/docker
- canonical/docker engine
- vendor/redhat
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/7.0