CVE-2019-14271: Code Injection
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-14271?
CVE-2019-14271 is a vulnerability in Docker 19.03.x that allows code injection when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.
Which software versions are affected by CVE-2019-14271?
Docker versions 19.03.x before 19.03.1, Debian Linux 10.0, openSUSE Leap 15.0 and 15.1 are affected by CVE-2019-14271.
What is the severity of CVE-2019-14271?
CVE-2019-14271 has a severity rating of 9.8 (critical).
How can I fix CVE-2019-14271?
To fix CVE-2019-14271, update Docker to version 19.03.1 or newer.
Where can I find more information about CVE-2019-14271?
You can find more information about CVE-2019-14271 at the following references: - [GitHub Issue](https://github.com/moby/moby/issues/39449) - [GitHub Pull Request](https://github.com/moby/moby/pull/39612) - [Docker Engine Pull Request](https://github.com/docker/engine/pull/305)